Overwhelming a switch's CAM table so it starts broadcasting traffic to every port like a hub, letting an attacker sniff frames meant for other hosts.
Attack
- Flood the switch with frames using thousands of fake source MAC addresses
- CAM table fills up and can't learn any more legitimate entries
- Switch fails open — floods unknown-destination frames to all ports
- Attacker sniffs traffic that wasn't meant for their port
Defense
- Enable port security to cap MAC addresses per port
- Use sticky learning so only the first-seen MAC is trusted
- Set a violation action (protect, restrict, or shutdown)
Switch(config)# interface fastEthernet 0/1
Switch(config-if)# switchport mode access
Switch(config-if)# switchport port-security
Switch(config-if)# switchport port-security maximum 1
Switch(config-if)# switchport port-security mac-address sticky
Switch(config-if)# switchport port-security violation shutdown
Switch spoofing (DTP attack)
An attacker's PC pretends to be a switch and negotiates a trunk link over Dynamic Trunking Protocol, gaining access to every VLAN on that trunk.
Attack
- Attacker sends DTP frames claiming to be trunk-capable
- Port set to
dynamic auto/dynamic desirable agrees to trunk
- Attacker's NIC now receives tagged traffic from every VLAN
Defense
- Manually set every access port to access mode
- Disable DTP negotiation entirely on those ports
- Never leave user-facing ports on
dynamic auto
Switch(config)# interface fastEthernet 0/2
Switch(config-if)# switchport mode access
Switch(config-if)# switchport nonegotiate
VLAN hopping (double-tagging)
A frame carrying two 802.1Q tags can slip from the attacker's VLAN into another VLAN entirely — but only when the trunk's native VLAN matches the attacker's VLAN.
Attack
- Craft a frame with an outer tag matching the trunk's native VLAN
- First switch strips the outer tag (native VLANs travel untagged)
- Frame still carries the inner tag for the target VLAN
- Next switch reads the inner tag and delivers it into the target VLAN
Defense
- Change the trunk's native VLAN to an unused VLAN ID
- Never let native VLAN match any access VLAN in use
- Explicitly prune unused VLANs off trunk links
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# switchport trunk native vlan 999
Switch(config-if)# switchport trunk allowed vlan 10,20,30
Remember: if the native VLAN on the trunk still matches an access VLAN that's actually in use, double-tagging still works even if everything else is locked down.
ARP poisoning & Dynamic ARP Inspection
ARP has no authentication — an attacker can send forged replies to redirect traffic through their own machine (man-in-the-middle).
Attack
- Send unsolicited ARP replies mapping another host's IP to the attacker's MAC
- Victims update their ARP cache and send traffic to the attacker instead
- Attacker can sniff, alter, or drop the intercepted traffic
Defense
- Enable DHCP snooping first — DAI depends on its binding table
- Enable DAI on the relevant VLANs
- Mark uplink/trusted ports so legitimate ARP isn't blocked
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10
Switch(config)# ip arp inspection vlan 10
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# ip dhcp snooping trust
Switch(config-if)# ip arp inspection trust
Common trap: port security, DHCP snooping alone, and IP Source Guard each stop a different problem — none of them inspect ARP traffic. DAI is the only one that actually validates ARP packets.
Filters DHCP traffic so only trusted ports (usually uplinks to the real DHCP server) can hand out IP addresses — stops rogue DHCP servers and builds the binding table other defenses rely on.
Switch(config)# ip dhcp snooping
Switch(config)# ip dhcp snooping vlan 10
Switch(config)# interface gigabitEthernet 0/1
Switch(config-if)# ip dhcp snooping trust
Why it matters beyond DHCP: the binding table it builds (IP ↔ MAC ↔ port) is what DAI and IP Source Guard both check against.
Blocks a host from sending traffic under an IP address that isn't its own, using the same DHCP snooping binding table.
Switch(config)# interface fastEthernet 0/3
Switch(config-if)# ip verify source port-security
Scope check: stops IP spoofing on that port — it doesn't inspect ARP traffic, so it's not a substitute for DAI against ARP poisoning.
What each defense actually stops, at a glance.
| Feature | Stops | Depends on |
|---|
| Port security | MAC flooding, unauthorized devices | Nothing |
switchport nonegotiate | Switch spoofing (DTP trunk negotiation) | Nothing |
| Native VLAN change | VLAN hopping (double-tagging) | Nothing |
| DHCP snooping | Rogue DHCP servers | Nothing (foundation for the two below) |
| Dynamic ARP Inspection | ARP poisoning / MITM | DHCP snooping |
| IP Source Guard | IP address spoofing | DHCP snooping |