PROTECTION AGAINST CAM TABLE OVERFLOW ATTACKS ON L2+ DEVICES

In modern local area networks, the CAM Table Overflow attack poses a critical L2 security threat, causing the switch's MAC address table to become flooded with a flood of fake addresses. A successful attack puts the device into flooding mode, allowing the attacker to intercept sensitive traffic and places a critical load on hardware resources (CPU up to 85%, RAM up to 75%), disrupting network service availability. The objective of this study was to compare mitigation methods for this threat: Port Security, Storm Control, and DHCP Snooping. The research methodology included attack simulation using the macof utility and an evaluation of the effectiveness of defense mechanisms on Cisco, Eltex, and MikroTik equipment. The selection criteria included response speed, blocking accuracy, and impact on traffic. The experimental results confirmed the superiority of Port Security technology. When this mechanism is activated, the switch instantly (within 2-5 seconds) blocks the intruder's port in secure-shutdown mode, limiting the table to two entries instead of 8124. CPU load is reduced to 10%, and RAM is unloaded to 35%, while legitimate nodes continue to operate. Unlike similar mechanisms, Port Security provides direct protection against the root cause of the attack, rather than merely mitigating its consequences. It is concluded that implementing Port Security is the most universal and reliable solution for protecting L2+ switches from CAM table overflows. It is recommended to use this mechanism as a basic one.