MAC address flooding - Revision history

Heth at 12:04, 11 September 2012

2012-09-11T12:04:43Z

Heth: /* Port shutdown */

2012-09-11T12:03:38Z

‎Port shutdown

Heth: /* Allow legal traffic and discard rest. SNMP trap logging */

2009-05-09T04:35:42Z

‎Allow legal traffic and discard rest. SNMP trap logging

Heth: /* What is MAC address flooding */

2009-05-09T04:34:46Z

‎What is MAC address flooding

Heth at 17:17, 7 May 2009

2009-05-07T17:17:52Z

Heth at 17:15, 7 May 2009

2009-05-07T17:15:01Z

Heth: New page: Category:CiscoCategory:CCNACategory:CCNPCategory:IOSCategory:NetworkCategory:CCNP3

2009-05-07T16:55:41Z

New page: Category:Cisco Category:CCNA Category:CCNP Category:IOS Category:Network Category:CCNP3

New page

[[Category:Cisco]][[Category:CCNA]][[Category:CCNP]][[Category:IOS]][[Category:Network]][[Category:CCNP3]]

@@ Line 8: / Line 8: @@
 === Port shutdown ===
 If you want the port to go in '''err-disabled''' if more than five MAC-addresses are seen on the port
-<pre>
+<source lang=cli>
 Switch(config)# interface range fastethernet 0/1 - 24
 Switch(config-if)switchport port-security maximum 5
 Switch(config-if)switchport port-security violation shutdown
-</pre>
+</source>
 === Allow legal traffic and discard rest. No logging ===
 If you want the port continue forwarding traffic from five MAC-addresses and discard remaining traffic and you ''don't'' want to log the attempt to use more than five MAC-addresses, use:
-<pre>
+<source lang=cli>
-Switch(config)# interface fastethernet 0/1 - 24
+Switch(config)# interface range fastethernet 0/1 - 24
 Switch(config-if)switchport port-security maximum 5
 Switch(config-if)switchport port-security violation protect
-</pre>
+</source>
 === Allow legal traffic and discard rest. SNMP trap logging ===
 If you want the port continue forwarding traffic from five MAC-addresses and discard remaining traffic and you want to log the attempt to use more than five MAC-addresses. [[SNMP]] traps are sent, use:
-<pre>
+<source lang=cli>
-Switch(config)# interface fastethernet 0/1 - 24
+Switch(config)# interface range fastethernet 0/1 - 24
 Switch(config-if)switchport port-security maximum 5
 Switch(config-if)switchport port-security violation restrict
-</pre>
+</source>
+{{Source cli}}
 [[Category:Cisco]][[Category:CCNA]][[Category:CCNP]][[Category:IOS]][[Category:Network]][[Category:CCNP3]]

@@ Line 9: / Line 9: @@
 If you want the port to go in '''err-disabled''' if more than five MAC-addresses are seen on the port
 <pre>
-Switch(config)# interface fastethernet 0/1 - 24
+Switch(config)# interface range fastethernet 0/1 - 24
 Switch(config-if)switchport port-security maximum 5
 Switch(config-if)switchport port-security violation shutdown
 </pre>
 === Allow legal traffic and discard rest. No logging ===
 If you want the port continue forwarding traffic from five MAC-addresses and discard remaining traffic and you ''don't'' want to log the attempt to use more than five MAC-addresses, use:

@@ Line 27: / Line 27: @@
 Switch(config-if)switchport port-security violation restrict
 </pre>
 [[Category:Cisco]][[Category:CCNA]][[Category:CCNP]][[Category:IOS]][[Category:Network]][[Category:CCNP3]]

@@ Line 1: / Line 1: @@
 = What is MAC address flooding =
-MAC address flooding is an attack where the attacker sends lots of frames to the switch with random ''source MAC addresses'' and flooding the MAC-address table in the switch. The CAM - Content Addressable Memory - gets full, and frames from valid hosts are flooded out of all ports.
+MAC address flooding is an attack where the attacker sends frames to the switch with random ''source MAC addresses'' and flooding the MAC-address table in the switch. The CAM - Content Addressable Memory - gets full, and frames from valid hosts are flooded out of all ports.
 = Protecting against MAC Address flooding =
 Is done on a port basis.

@@ Line 13: / Line 13: @@
 </pre>
 === Allow legal traffic and discard rest. No logging ===
-If you want the port to go in '''err-disabled''' if more than five MAC-addresses are seen on the port
+If you want the port continue forwarding traffic from five MAC-addresses and discard remaining traffic and you ''don't'' want to log the attempt to use more than five MAC-addresses, use:
 <pre>
 Switch(config)# interface fastethernet 0/1 - 24
@@ Line 20: / Line 20: @@
 </pre>
 === Allow legal traffic and discard rest. SNMP trap logging ===
-If you want the port to go in '''err-disabled''' if more than five MAC-addresses are seen on the port
+If you want the port continue forwarding traffic from five MAC-addresses and discard remaining traffic and you want to log the attempt to use more than five MAC-addresses. [[SNMP]] traps are sent, use:
 <pre>
 Switch(config)# interface fastethernet 0/1 - 24

← Older revision		Revision as of 17:15, 7 May 2009
Line 1:		Line 1:
		+	= What is MAC address flooding =
		+	MAC address flooding is an attack where the attacker sends lots of frames to the switch with random ''source MAC addresses'' and flooding the MAC-address table in the switch. The CAM - Content Addressable Memory - gets full, and frames from valid hosts are flooded out of all ports.
		+	= Protecting against MAC Address flooding =
		+	Is done on a port basis.
		+	== Example ==
		+	Up to five MAC address are allowed on user ports.
		+	=== Port shutdown ===
		+	If you want the port to go in '''err-disabled''' if more than five MAC-addresses are seen on the port
		+	<pre>
		+	Switch(config)# interface fastethernet 0/1 - 24
		+	Switch(config-if)switchport port-security maximum 5
		+	Switch(config-if)switchport port-security violation shutdown
		+	</pre>
		+	=== Allow legal traffic and discard rest. No logging ===
		+	If you want the port to go in '''err-disabled''' if more than five MAC-addresses are seen on the port
		+	<pre>
		+	Switch(config)# interface fastethernet 0/1 - 24
		+	Switch(config-if)switchport port-security maximum 5
		+	Switch(config-if)switchport port-security violation protect
		+	</pre>
		+	=== Allow legal traffic and discard rest. SNMP trap logging ===
		+	If you want the port to go in '''err-disabled''' if more than five MAC-addresses are seen on the port
		+	<pre>
		+	Switch(config)# interface fastethernet 0/1 - 24
		+	Switch(config-if)switchport port-security maximum 5
		+	Switch(config-if)switchport port-security violation restrict
		+	</pre>
		+
		+
		+	</pre>
		+
		+
	[[Category:Cisco]][[Category:CCNA]][[Category:CCNP]][[Category:IOS]][[Category:Network]][[Category:CCNP3]]		[[Category:Cisco]][[Category:CCNA]][[Category:CCNP]][[Category:IOS]][[Category:Network]][[Category:CCNP3]]