This document provides an overview of layer 2 attacks and mitigation techniques for the Cisco Catalyst 6500 series switches running Cisco IOS software. It focuses on the MAC Address Overflow Attack and provides techniques to mitigate this type of attack.
The paper describes how layer‑2 attacks, specifically MAC address overflow attacks, can compromise Cisco Catalyst 6500 series switches. It outlines the attack methodology, the impact on the switch’s CAM table, and recommended mitigation steps.
A test lab using a Cisco Catalyst 6509E with a Supervisor 720‑3B, WS‑X6748‑GE‑TX line card, and various client machines (MacBook Pro, Lenovo T61P) was built. The attack was executed with Ettercap NG‑0.7.3, and packet captures were taken with Wireshark to illustrate the effect on the CAM table and network traffic.
| Switch model | Cisco Catalyst 6509E with Supervisor 720-3B |
|---|---|
| Line card | WS-X6748-GE-TX (10/100/1000) Ethernet |
| IOS version | 12.2(33)SXI1 |
It overflows the switch’s Content‑Addressable Memory (CAM) table, forcing packets for new flows to be flooded out all ports.
Mitigation includes clearing the dynamic MAC‑address table before the attack and applying configuration changes such as adjusting Ettercap settings to limit traffic generation.
The attack was carried out with Ettercap NG‑0.7.3 running on an Ubuntu virtual machine.