Reminder: MAC addresses are 48 bits / 6 bytes

The first half of a MAC address is called the Organizationally Unique Identifier (OUI)

• the manufacturer

The latter half of a MAC address is called the Network Interface Controller-Specific

• the serial number
• "burned in address"

Table in the switch keeps track of MAC addresses and which interfaces they are associated with

• Entries in this table are typically cached and age out periodically

MAC address table creation

• All inbound MAC addresses are recorded if not already in the table
  • The interface over which the traffic was received is recorded as the "output interface"
• Any traffic of which the destination MAC is not know persists as "inbound" traffic

MAC addresses tables are central to the switching process

Mac Flooding

The MAC address table begins to fill up as more devices send traffic over a switch. Once it does fill up, all traffic will be automatically forwarded to every interface on the switch.

• This allows an attacker to see all traffic being sent over a switch
• Modern switches' port security setting allow MAC flooding to be restricted