Security – What kind of network attack turns a switch into a hub

Securityswitch

I read an article today describing how a penetration tester was able to demonstrate creating a fake bank account with a $14 million balance. However, one paragraph describing the attack stood out:

Then he "flooded" switches — small boxes that direct data traffic —
to overwhelm the bank's internal network with data. That kind of
attack turns the switch into a "hub" that broadcasts data out
indiscriminately.

I'm not familiar with the effect that is described. Is it really possible to force a switch to broadcast traffic to all of its ports by sending massive amounts of traffic? What exactly is going on in this situation?

Best Answer

This is called MAC flooding. A "MAC address" is an Ethernet hardware address. A switch maintains a CAM table that maps MAC addresses to ports.

If a switch has to send a packet to a MAC address not in its CAM table, it floods it to all ports just like a hub does. So if you flood a switch with a larger number of MAC addresses, you will force the entries of legitimate MAC addresses out of the CAM table and their traffic will be flooded to all ports.