Статьи

PROTECTION AGAINST CAM TABLE OVERFLOW ATTACKS ON L2+ DEVICES

A. V. Fomenko , Y. Y. Zelenov
UDC: 004.056 EDN: ZSMKDX Published: 01.09.2025 Issue: Vol. 3 No. 007 (2025): Professionalitet, 2025
Download PDF Article on eLIBRARY.RU

Abstract

In modern local area networks, the CAM Table Overflow attack poses a critical L2 security threat, causing the switch's MAC address table to become flooded with a flood of fake addresses. A successful attack puts the device into flooding mode, allowing the attacker to intercept sensitive traffic and places a critical load on hardware resources (CPU up to 85%, RAM up to 75%), disrupting network service availability. The objective of this study was to compare mitigation methods for this threat: Port Security, Storm Control, and DHCP Snooping. The research methodology included attack simulation using the macof utility and an evaluation of the effectiveness of defense mechanisms on Cisco, Eltex, and MikroTik equipment. The selection criteria included response speed, blocking accuracy, and impact on traffic. The experimental results confirmed the superiority of Port Security technology. When this mechanism is activated, the switch instantly (within 2-5 seconds) blocks the intruder's port in secure-shutdown mode, limiting the table to two entries instead of 8124. CPU load is reduced to 10%, and RAM is unloaded to 35%, while legitimate nodes continue to operate. Unlike similar mechanisms, Port Security provides direct protection against the root cause of the attack, rather than merely mitigating its consequences. It is concluded that implementing Port Security is the most universal and reliable solution for protecting L2+ switches from CAM table overflows. It is recommended to use this mechanism as a basic one.

Online viewer

References

  1. Олифер, В. Г. Компьютерные сети. Принципы, технологии, протоколы : учебник для вузов / В. Г. Олифер, Н. А. Олифер. — 5-е изд., юбил. – Санкт-Петербург : Питер, 2021. – 1008 с. : ил. – (Серия «Учебник для вузов»). – ISBN 978-5-4461-1584-0.
  2. АТАКА CAM-TABLE OVERFLOW. МЕТОДЫ ЗАЩИТЫ [Электронный ресурс] // Security.Lab – URL: https://cyberleninka.ru/article/n/ataka-cam-table-overflow-metody-zaschity (дата обращения: 11.11.2025).
  3. Настройка Port Security на коммутаторах SNR / [Электронный ресурс] // Документация NAG: [сайт]. – URL: https://nag.wiki/pages/viewpage.action?pageId=25107728(дата обращения 11.11.2025)
  4. Уймин, А. Г. Компьютерные сети. L2-технологии: Практикум / А. Г. Уймин. – Москва: Ай Пи Ар Медиа, 2024. - 191 с. – ISBN 978-5-4497-2539-4. EDN AXDYGY
  5. Cisco Catalyst 2960 Series Switches Configuration Guide [Электронный ресурс] // Cisco Systems. – 2023. URL: https://www.cisco.com/c/en/us/support/switches/catalyst-2960-series switches/products-installation-and-configuration-guides-list.html.
  6. Основы сетевой безопасности: защита коммутаторов L2 [Электронный ресурс] // Habr: статья. – 2020. – URL: https://habr.com/ru/articles/502480/ (дата обращения: 11.01.2025).
  7. Трещев И.А. «О реализации атак типа MAC-FLOOD» / статья (eLIBRARY / научная публикация). // 2022. URL: https://elibrary.ru/item.asp?id=49992198 (дата обращения 11.11.2025).
  8. Настройка Port Security на коммутаторах Eltex MES1400/MES2400 // База знаний Eltex [Электронный ресурс] // Документация. – URL: https://eltexcm.ru/baza-znanij/ethernet-kommutatory-mes/mes14xx24xx3400-xx37xx/interfejsy-vlan/mes-nastrojka-port-security-mes1400-mes2400.html

License

Copyright (c) 2025 A. V. Fomenko, Ya. Yu. Zelenov (Author)

Creative Commons Attribution (CC BY) 4.0

Keywords

Port Security CAM table MAC address L2+ device switch protection traffic interception