What is MAC flooding?
MAC flooding is an attack against a network switch, aimed at turning it into something closer to a dumb hub so the attacker can capture traffic that should never reach their port. A switch normally forwards each frame only to the port where the destination device lives, which is why an attacker on a switched network sees little beyond their own traffic. MAC flooding attacks the memory that makes that forwarding possible.
How it fills the CAM table
A switch learns which MAC address sits behind which port and records the pairs in a content-addressable memory (CAM) table. That table is finite. In a MAC flooding attack, the attacker sends a torrent of frames with thousands of different forged source MAC addresses, each one a new entry, until the table is full. With no room to learn the real destinations, many switches fail open: they fall back to flooding frames for unknown destinations out of every port in the VLAN, much as a hub would. Now the attacker's port receives copies of other devices' traffic, which can then be sniffed for cleartext credentials and data.
What it looks like in practice
Tools built for this, such as macof, send thousands of frames with bogus source addresses every second. The switch treats each one as a new device to learn, so the table stays full, and genuine entries that age out cannot be learned again. The effect is usually not a crash: the network keeps running, just less privately, though the burst of new addresses on one port is easy to spot in switch logs and port statistics.
How to defend against it
The direct control is port security, a switch feature that limits how many MAC addresses a single port may learn and reacts when the limit is exceeded, usually by shutting the port into an error-disabled state or dropping the extra addresses. Binding a port to specific known addresses (sticky MAC) tightens it further, and 802.1X authentication stops an unapproved device from using the port at all. Because the attack needs a physical or wireless foothold on the segment, disabling unused ports also helps.
MAC flooding on the CompTIA Security+ exam
MAC flooding sits among the on-path and sniffing techniques under SY0-801 objective 2.5. The scenario clue is a switch suddenly flooding traffic to every port, or logs showing one port learning thousands of MAC addresses in seconds. The control the exam wants is port security. Keep it distinct from ARP poisoning, which forges replies to redirect one host's traffic, and from a plain sniffer on a mirror port, which needs no flooding at all.