SEC: macof — MAC Flooding Attack Tool

What is macof?

macof is a Linux-based network tool included in the dsniff suite, designed to perform MAC flooding attacks against Ethernet switches. It generates a high volume of Ethernet frames with randomized source MAC addresses to overflow the switch's Content Addressable Memory (CAM) table.

macof is capable of generating approximately 131,000 bogus MAC entries per minute.

How MAC Flooding Works

To understand macof, you first need to understand how Layer 2 switches operate.

Normal Switch Behavior

A network switch maintains a CAM table (Content Addressable Memory) that maps MAC addresses to specific switch ports. When a frame arrives, the switch looks up the destination MAC in the CAM table and forwards the frame only to the correct port.

Normal Switch Operation:
+---CAM Table---+
| MAC Address   | Port |
|---------------|------|
| AA:BB:CC:1:1:1| Port 1 |
| DD:EE:FF:2:2:2| Port 2 |
| 11:22:33:4:4:4| Port 3 |
+---------------+------+

Frame destined for AA:BB:CC:1:1:1 → forwarded ONLY to Port 1

MAC Flood Attack Behavior

When the CAM table is full, the switch can no longer make forwarding decisions for new MAC addresses. It fails open — broadcasting all traffic to every port on the network, effectively behaving like a hub.

After MAC Flood:
CAM Table FULL (131,000+ fake entries)
     |
Switch cannot find legitimate MAC addresses in table
     |
Switch broadcasts all frames to ALL ports
     |
Attacker on any port receives ALL network traffic
     |
Attacker captures credentials, session tokens, sensitive data

Using macof

# Basic MAC flood on interface eth0, send 10 packets
macof -i eth0 -n 10

# Explanation:
# -i eth0   → target network interface
# -n 10     → number of packets to send

Common macof Options

Attack Scenario

Network Topology:
PC-A (Attacker) ----+
                    |
PC-B (Victim1) -----+----- [Switch] ----- Server
                    |
PC-C (Victim2) ----+

Step 1: Attacker runs macof to flood the CAM table
        macof -i eth0

Step 2: CAM table fills with 131,000+ fake MAC entries

Step 3: Switch fails open and broadcasts everything

Step 4: Attacker sniffs all traffic:
        - PC-B's communication with Server
        - PC-C's communication with Server
        - Credentials, session tokens, file transfers

Practical Impact

Once the switch is flooding all traffic, the attacker can use packet capture tools to extract sensitive information:

# Start packet capture while macof runs
tcpdump -i eth0 -w captured.pcap

# Or use Wireshark to view traffic in real time

Combined with the switch's broadcast behavior, the attacker can effectively sniff the entire local network segment without needing to perform ARP spoofing.

Detection and Defense

Detection:

• Monitor CAM table utilization on managed switches
• Network behavior anomaly detection systems can flag unusual MAC address rates
• Examine switch logs for CAM table overflow events

Defense:

• Port security — configure switches to limit the number of MAC addresses per port
• Dynamic ARP Inspection (DAI) — validates ARP packets to prevent spoofing
• 802.1X Network Access Control — authenticate devices before granting network access
• VLAN segmentation — limit the broadcast domain so a flood only affects a single segment

Cisco Switch Port Security (example config):
interface FastEthernet0/1
 switchport mode access
 switchport port-security
 switchport port-security maximum 2
 switchport port-security violation shutdown

Legal Notice

macof is a security testing tool. Using it against networks without explicit written authorization is illegal under computer fraud laws in most jurisdictions. Use only in authorized lab environments, CTF competitions, or penetration tests with documented scope.