What is a MAC Flooding attack?

MAC Flooding is a layer-2 attack against network switches. The attacker floods the switch with thousands of Ethernet frames using fake source MAC addresses until its CAM table (which maps MACs to ports) fills up. When the table saturates, many switches enter failopen mode and start forwarding all traffic to every port, like a hub.

Why is it dangerous?

In failopen mode, an attacker plugged into the switch can sniff traffic meant for other machines on the same network: credentials, sessions, sensitive data. It's a stepping stone to man-in-the-middle attacks inside poorly protected local networks.

How to prevent it?

The main defense is Port Security on the switch: limit how many MACs are learned per port and block or shut the port on excess. 802.1X device authentication, VLAN segmentation, and CAM-table monitoring complement it.