Sending multiple MAC addresses to the same port on a switch

Question

What could happen if someone continuously sends frames with different source MAC addresses to the same port on a switch? Knowing that this port doesn't apply the "port-security" mode.

Answer 1

That depends on the firmware of the equipment. Since you asked, "What COULD happen," I'll enumerate (from the POV of an embedded software engineer) what I can think of.

• The switch may pass all frames on regardless of the source MAC.
• The switch may reject frames arriving at a single port when the source MAC differs from the source MAC recorded when the wire protocol began if a breach of that protocol has not been detected.
• The switch may record the discrepancies in a log that network engineers can read after authenticating with the device.
• A bug could be triggered, rendering the device unstable or inoperative until rebooted.

The first of these may be a security risk depending on the nature and security in place on the other equipment receiving such passed frames.

Answer 2

If no security/restriction features are in place then the switch will store all the source MAC addresses it sees in it's switching table.

That table will fill up and the switch will have to evict an existing entry to create the new one.

When a destination MAC address is not in the table frames sent to that MAC address will be flooded out of all ports. Hence MAC flooding can be used by an attacker as a way of sniffing traffic that would otherwise not be visible to them.