MicroNugget: What is a CAM Table Overflow Attack?

In this video, Keith Barker covers CAM table overflow attacks and how to prevent them. A potential eavesdropper on your switch may try to use a CAM table overflow attack in order to view every frame that passes through the switch. Learn to identify one and prevent it.

Imagine this: you've got a disgruntled employee or an unscrupulous competitor who wants to try and peer into your network by seeing all the traffic that passes through a switch.

Normally, one of the benefits of using a Layer 2 switch is that by default it memorizes source and destination ports and sends traffic only to those ports. This provides simple security: traffic automatically goes only where it's intended.

But that functionality is provided by content addressable memory tables that enable the switch to remember every source and destination address connected to it. With the right tools, those CAM tables can be flooded with information.

When the CAM tables overflow, the switch "forgets" who is who, and instead starts broadcasting all the information it receives to all ports. Now an eavesdropper sees every frame that passes through that switch.

Keith explains the process of a CAM table overflow attack, how to identify it, and what you can do to prevent it.

Start learning with CBT Nuggets:

[tubiak]

I knew about MAC flooding but i thought by default most of switches have separate MAC tables for each port so when you flood one you will block only this particular port not the entire switch.

[bijubalan]

Keith, if we are pinging from a switch and the destination is some host connected to other switch and we have a trunk link between the 2 switches, before sending that frame over the trunk link, what VLAN ID it will use to tag the packet? I mean the the traffic was originated from the switch not from a host in a particular VLAN.