MAC flooding: port security and MAC limits
32,768. That is how many unicast MAC addresses a Catalyst 9300 holds in its default access template. It sounds like a lot.
One device on a single port can try to fill it with invented addresses, and a switch that no longer knows where a host is sends its frames everywhere.
The technique
A switch learns which MAC address sits behind which port, in a table of fixed size. Flood it with made up source addresses, and the real ones no longer fit.
Port security is disabled by default on Cisco and on Huawei, and Juniper says MAC limiting is not enabled by default. Nothing stops one port from claiming address after address.
How easy is it?
One access port. No account, and no special rights: every switch learns source addresses from every frame it receives. That is simply how switching works.
How it works, in principle
The attacker's port sends frames from address after address. The table fills.
When a host then sends to a neighbour whose entry is gone, the switch floods the frame out of every port in the VLAN, the attacker's included. Traffic meant for one host is copied to all of them.
The impact
Frames meant for other hosts reach the attacker's port. Every host in the VLAN is exposed while the table stays full.
And learned entries only age out after 300 seconds by default, on all four vendors.
How to close it
Turn on port security on access ports, and cap the addresses per port: Cisco, Huawei and Aruba all default to one address once it is on.
Mind the reaction to a violation, because it differs: Cisco shuts the port by default, Huawei drops and alerts, and Aruba only notifies.
On Juniper, set a MAC limit per interface. Storm control adds a second line, and it is on by default on Juniper EX, at 80 percent.
What NacTrack shows
NacTrack checks Cisco and Huawei access switches for port security or a MAC limit.
Sources
Sources: Cisco Catalyst 9300 guides, Huawei port security guides, Aruba AOS-CX 10.14, Juniper EX MAC limiting and storm control.
Defensive education: the attack is shown in principle only, with no exploitation steps, tools or payloads. Command outputs and configurations are examples; check your platform and release in the vendor's documentation.
Know where your network is exposed
NacTrack reads versions and configurations off your devices, and checks them against published advisories.