Статьи

IMPACT OF MAC-FLOODING ATTACKS ON L2 SWITCHES IN A HYBRID NETWORK INFRASTRUCTURE

E. A. Eremina , A. N. Prostova
UDC: 004.056.53 EDN: VWJYDY Published: 01.06.2025 Issue: Vol. 2 No. 006 (2025): Professionalitet, 2025
Download PDF Article on eLIBRARY.RU

Abstract

The conducted research reveals the critical vulnerability of L3 devices in hybrid networks during attacks at the channel level. It has been experimentally shown that a classic MAC flooding attack aimed at overflowing the CAM tables of access switches leads not only to a violation of the confidentiality of traffic at the L2 level, but also causes a cascading increase in load on routers (L3) due to the massive generation of unknown unicast traffic. This traffic is redirected to the router, leading to a critical load on its processor, increased response time, and a possible denial of service for the entire network infrastructure. The paper provides comparative testing of standard protection mechanisms (Port Security, Storm Control) on equipment from various manufacturers under simulated attack conditions. Experiments were conducted on the stand using Cisco, Mikrotik, and Eltex equipment, and the attack was generated using Kali Linux tools. The results demonstrate that activating Port Security in shutdown mode on access ports is the most effective way to block an attack at the source. To ensure the integrated stability of a hybrid network, this measure must be complemented by limiting broadcast traffic at the router level. The data obtained is of great practical importance for ensuring the fault tolerance and security of modern hybrid network infrastructures combining equipment from various vendors, and allows us to formulate practical recommendations for configuring security for networks combining equipment from various manufacturers in order to prevent the escalation of L2 attacks to the L3 layer.

Online viewer

References

  1. Уровни OSI: простое объяснение и отличия коммутаторов L1, L2 и L3 : [сайт]. – Москва, 2024. – URL: https://servergate.ru/articles/otlichiya-kommutatorov-l1-l2-i-l3/ (дата обращения: 05.11.2025). – Текст: электронный.
  2. Что такое MAC Flooding? Как его предотвратить? : [сайт] / Alexhost. – 2024. – URL: https://alexhost.com/ru/faq/what-is-mac-flooding-how-to-prevent-it/ (дата обращения: 20.11.2025).– Текст: электронный.
  3. Gontharet, F. Man-in-The-Middle Attacks & Countermeasures Analysis [Электронный ресурс]. – Dundee : University of Abertay Dundee, 2015. – 66 с. – URL: https://www.researchgate.net/publication/340720434_Man-in-The-Middle_Attacks_Countermeasures_Analysis (дата обращения: 10.12.2025). – Текст: электронный.
  4. Thakur, S. Three tier architecture with enhanced security at layer 2 And layer 3 [Электронный ресурс] / S. Thakur, A. Khan, J. Dave, S. Kaulgud // International Advanced Research Journal in Science, Engineering and Technology. – 2018. – Vol. 5, Special Issue 3. – С. 13-18. – URL: https://clck.ru/3Qy9Ak (дата обращения: 10.12.2025). – Текст: электронный.
  5. Скоробогатов, С. Ю. Методика прогнозирования воздействия компьютерных атак на элементы программно-конфигурируемой сети [Электронный ресурс] / С. Ю. Скоробогатов, И. М. Жданова, А. В. Кузнецов, А. А. Осипенко, Р. Р. Хабушев // Известия Тульского государственного университета. Технические науки. – 2023. – Вып. 2. – С. 269–274. – DOI: 10.24412/2071-6168-2023-2-269-274. – URL: https://cyberleninka.ru/article/n/metodika-prognozirovaniya-vozdeystviya-kompyuternyh-atak-na-elementy-programmno-konfiguriruemoy-seti (дата обращения: 11.12.2025). – Текст: электронный.
  6. Configure Dynamic Host Configuration Protocol (DHCP) Snooping on a Switch through the Command Line Interface (CLI) : [сайт] / Cisco. – 2018. – URL: https://www.cisco.com/c/en/us/support/docs/smb/switches/cisco-small-business-300-series-managed-switches/smb5515-configure-dynamic-host-configuration-protocol-dhcp-snooping.html (дата обращения: 20.12.2025). – Текст: электронный.
  7. Уймин, А. Г. Компьютерные сети. L2-технологии : практикум для СПО / А. Г. Уймин. – Саратов, Москва : Профобразование, Ай Пи Ар Медиа, 2024. – 190 c. – ISBN 978-5-4497-2559-2, 978-5-4488-1745-8. – Текст : электронный // Цифровой образовательный ресурс IPR SMART : [сайт]. – URL: https://www.iprbookshop.ru/135231.html (дата обращения: 15.11.2025). – Режим доступа: для авторизир. пользователей. – Текст: электронный.
  8. Защита от атаки с переполнением MAC-адреса : [сайт] / R. Brezular. – 2024. – URL: https://brezular.com/2024/01/03/protecting-against-mac-flooding-attack/ (дата обращения: 09.12.2025). – Текст: электронный.

License

Copyright (c) 2025 E. A. Eremina, A. N. Prostova (Author)

Creative Commons Attribution (CC BY) 4.0

Keywords

MAC-flooding Port Security CAM table L2 switch L3 router network security unknown unicast