RE: about CAM table overflow attack?

["David Gillett" <gillettdavid () fhda edu>]

  The switch has a separate CAM table for every VLAN.  Whether the filling
of the CAM 
table for one VLAN affects just that VLAN, or the entire switch, will
depend on how those
tables are allocated, and will vary from manufacturer to manufacturer, and
perhaps from
model to model and code release to code release.

  However:  The attacker's port is usually a member of a specific VLAN, and
a working
switch will only deliver traffic to that port if it's within that VLAN.
  Also, there will be traffic on that VLAN that the attacker does not see
*unless* he
overflows the CAM tables for that VLAN on every switch in the network.

David Gillett


> -----Original Message-----
> From: Monty Ree [mailto:chulmin2 () hotmail com] 
> Sent: Tuesday, April 18, 2006 4:23 AM
> To: security-basics () securityfocus com
> Subject: about CAM table overflow attack?
>
> Hello, all.
>
> I have read some documents about CAM table overflow(or mac 
> flooding, switch
> jam) attack.
> I have some questions about this.
>
> If some attacker executes macof for sometime, so CAM tables 
> would be overflowed.
>
> 1. then attacker can see other traffic only which in a same VLAN? 
>
> 2. or attacker can see all traffic(over vlan) which switch 
> services, like dummy hub?
>
>
> Thanks in advance.
>
> _________________________________________________________________
> 확인하자. 오늘의 운세 무료 사주, 궁합, 작명, 전생 가이드   
> http://www.msn.co.kr/fortune/default.asp  
>
>
> --------------------------------------------------------------
> -----------
> This List Sponsored by: Webroot
>
> Don't leave your confidential company and customer records 
> un-protected. 
> Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no 
> obligation. See why so many companies trust Spy Sweeper Enterprise to 
> eradicate spyware from their networks.
> FREE 30-Day Trial of Spy Sweeper Enterprise
>
> http://www.webroot.com/forms/enterprise_lead.php
> --------------------------------------------------------------
> ------------


-------------------------------------------------------------------------
This List Sponsored by: Webroot

Don't leave your confidential company and customer records un-protected.
Try Webroot's Spy Sweeper Enterprise(TM) for 30 days for FREE with no
obligation. See why so many companies trust Spy Sweeper Enterprise to
eradicate spyware from their networks.
FREE 30-Day Trial of Spy Sweeper Enterprise

http://www.webroot.com/forms/enterprise_lead.php
--------------------------------------------------------------------------