Torch already answered most of the questions, but I'll go through and answer them as well.
1.) What is the MAC address threshold before it overflows? Is this totally switch dependent?
It is totally switch dependent. CAM Table entries are stored in RAM, so if you have a switch with a gigabyte of RAM, it's going to have a much higher threshold than one with 32 megabytes of RAM.
2.) What happens if the port security is enabled? Can you set the port security up on that switch and run your tests again and give us a screen shot with it enabled? Do the other PCs have to wait in queue or do they just get denied at every request until there is an opening?
If port security is enabled and configured properly it can do a number of things, it comes down to how it has been configured. For example, the following will enable port-security on all 24 switchports, and shutdown (and subsequently log) if more than 4 MAC addresses have connected to the port:
(config)# interface range fa0/1 - 24
(config-if)# switchport port-security
(config-if)# switchport port-security maximum 4
(config-if)# switchport port-security violation shutdown
If a violation does occur and shutdown is used, a log entry is made, and administrative intervention is needed to re-enable the port. This can be done with:
(config)# errdisable recovery cause security-violation
The other violation options are restrict, and protect. Protect drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value. Restrict drops packets with unknown source addresses until you remove a sufficient number of secure MAC addresses to drop below the maximum value and causes the SecurityViolation counter to increment.
I plan to write up a full tutorial on port-security tonight/tomorrow, so I'll get more into there (sticky MAC addresses and fun stuff like that).
3.) What would you say should be the number of MAC addresses allowed to connect to a switch at any given time? Let's say this is a Cisco Catalyst 3560 series.
Depends on the switch port. If a port is connected to a file server, it should have a sticky MAC address set, whereas if it's connected to a wireless access-point, up to a couple of hundred may be required.
4.) What are the proper steps to take to secure this. I believe this was in another thread if I remember correctly?
As I said, I'm going to create a new thread tonight/tomorrow on port-security, so you'll have to wait and see.
5.) Is flooding the entire network that beneficial with macof instead of picking the switch itself with -d switch? I would believe flooding the network could cause possible latency issues and lead to detection. Although, there should be other intrusion/detection programs running to detect this kind of attack on networks! =)
Yeah, you could use the -d flag, but that requires knowledge of the network. It probably is the safer bet to do so. Multi-layer IDS/IPS are available, I've never played with one though. It still doesn't hurt to stop this kind of attack before it's even started though.
Overall, very nice haZed. I enjoyed it a lot. Keep them coming man!
Thanks mate, glad you liked it.
2. I wonder if he has a Cisco at home.
Yes, I do. I have an 1801 router, which as an integrated 8-port switch. I'm working on getting a Catalyst 2960 switch for < $200, but I'll see how that goes. I also use GNS3/dynamips/PEMU for router and PIX/ASA simulation.
Is this just as effective as something like a MITM attack or even more effective? Why?
Torch already answered your question and he was spot on.
Author
