Which Attack Overflows an Ethernet Switch CAM Table?
Short answer
D MAC flooding exhausts the Ethernet switch's CAM table with spoofed source MAC addresses, causing the switch to flood traffic to all ports.
Question
Key Takeaways
The question tests knowledge of switched-network attacks: the trap is confusing CAM table exhaustion with other flood-based attacks such as DDoS or DNS cache flooding, which target different resources.
MAC flooding is the attack that exhausts an Ethernet switch's content-addressable memory (CAM) table by blasting thousands of fabricated source MAC addresses, forcing the switch to fail open and broadcast frames like a hub. This page confirms that MAC flooding (commonly executed with tools such as macof from the dsniff suite) is the correct answer among DDoS, evil twin, and DNS cache flooding.
Common mistake: Candidates often pick C (DNS cache flooding) because the word "flooding" matches, or A (DDoS attack) because it is generic; however, neither overflows a switch's CAM table — DDoS exhausts network or host resources, and DNS cache poisoning/flooding targets name resolvers, not switches.
Expert Analysis
Why the Answer Is Correct
MAC flooding (option D) sends a rapid stream of packets with spoofed source MAC addresses — typically generated by macof — until the switch's CAM table fills completely. When the CAM table overflows, many switches fall back to a fail-open behavior and start flooding all traffic out of every port, which lets the attacker capture frames intended for other hosts. This is the classic switched-environment attack described in the CEH Sniffing module, alongside techniques for defeating port security.
Why the Other Options Are Wrong
A DDoS attack (A) consumes bandwidth or service capacity on a target system; it does not specifically target the switch's MAC address table, and as the community noted, "A - doesn't deal with switches." An evil twin (B) is a wireless rogue-access-point attack that impersonates a legitimate SSID to harvest credentials, so it is a Wi-Fi technique rather than a Layer 2 switch attack. DNS cache flooding (C) targets name resolvers by injecting bogus records or exhausting resolver resources; "switches are not vulnerable to DNS cache flooding," so it cannot overflow a CAM table.
Community Comment Notes
The community reached a unanimous verdict of D. LordXander explained the eliminations clearly, noting "B - it's for WIFI" and that switches are not vulnerable to DNS cache flooding, while insaniunt simply confirmed "D. MAC flooding". One learner, qtygbapjpesdayazko, asked whether the method is genuinely effective — the answer is yes, though modern switches mitigate it with port security, sticky MAC limits, and 802.1X, which restrict how many MAC addresses a single port may learn.
Exam Strategy
Watch for the specific resource named in the stem (CAM table, ARP cache, DNS cache, session table) and match it to the attack family — MAC flooding is the only Layer 2 option here. Remember the tool names: macof/dsniff for MAC flooding, ettercap for ARP poisoning.
Frequently Asked Questions
Why is DNS cache flooding not the answer to a CAM table overflow question?
How does a switch behave after its CAM table is flooded?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Discussion 3 contributions
Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.
From public community threads 3
-
LordXander 👍 2 Answered DA - doesn't deal with switches B - it's for WIFI C - switches are not vulnerable to DNS cache flooding D - they are vulnerable to MAC flooding
-
qtygbapjpesdayazko 👍 1Could someone confirm the effectiveness of this ethical hacking method
-
insaniunt 👍 3 Answered DD. MAC flooding
Reader comments & corrections
No reader corrections yet — spotted an error or have a note? Share it below.