Which Attack Overflows an Ethernet Switch CAM Table?
Which type of attack attempts to overflow the content-addressable memory (CAM) table in an Ethernet switch?
Community Votes
100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.
Community Insight
The question tests knowledge of switched-network attacks: the trap is confusing CAM table exhaustion with other flood-based attacks such as DDoS or DNS cache flooding, which target different resources.
MAC flooding is the attack that exhausts an Ethernet switch's content-addressable memory (CAM) table by blasting thousands of fabricated source MAC addresses, forcing the switch to fail open and broadcast frames like a hub. This page confirms that MAC flooding (commonly executed with tools such as macof from the dsniff suite) is the correct answer among DDoS, evil twin, and DNS cache flooding.
Candidates often pick C (DNS cache flooding) because the word "flooding" matches, or A (DDoS attack) because it is generic; however, neither overflows a switch's CAM table — DDoS exhausts network or host resources, and DNS cache poisoning/flooding targets name resolvers, not switches.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
MAC flooding (option D) sends a rapid stream of packets with spoofed source MAC addresses — typically generated by macof — until the switch's CAM table fills completely. When the CAM table overflows, many switches fall back to a fail-open behavior and start flooding all traffic out of every port, which lets the attacker capture frames intended for other hosts. This is the classic switched-environment attack described in the CEH Sniffing module, alongside techniques for defeating port security.Why the Other Options Are Wrong
A DDoS attack (A) consumes bandwidth or service capacity on a target system; it does not specifically target the switch's MAC address table, and as the community noted, "A - doesn't deal with switches." An evil twin (B) is a wireless rogue-access-point attack that impersonates a legitimate SSID to harvest credentials, so it is a Wi-Fi technique rather than a Layer 2 switch attack. DNS cache flooding (C) targets name resolvers by injecting bogus records or exhausting resolver resources; "switches are not vulnerable to DNS cache flooding," so it cannot overflow a CAM table.Community Comment Notes
The community reached a unanimous verdict of D. LordXander explained the eliminations clearly, noting "B - it's for WIFI" and that switches are not vulnerable to DNS cache flooding, while insaniunt simply confirmed "D. MAC flooding". One learner, qtygbapjpesdayazko, asked whether the method is genuinely effective — the answer is yes, though modern switches mitigate it with port security, sticky MAC limits, and 802.1X, which restrict how many MAC addresses a single port may learn.Exam Strategy
Watch for the specific resource named in the stem (CAM table, ARP cache, DNS cache, session table) and match it to the attack family — MAC flooding is the only Layer 2 option here. Remember the tool names: macof/dsniff for MAC flooding, ettercap for ARP poisoning.
Frequently Asked Questions
Why is DNS cache flooding not the answer to a CAM table overflow question?
DNS cache flooding targets DNS resolvers by poisoning or exhausting resolver caches; an Ethernet switch has no DNS cache, only a CAM table for MAC-to-port mappings, so MAC flooding is the correct technique.
How does a switch behave after its CAM table is flooded?
Once the CAM table is full, many switches enter fail-open mode and forward unknown unicast frames out of every port like a hub, allowing an attacker on the network to sniff other hosts' traffic.