ccna certification verification

ccna certification verification.7.2.2 Introduction to Switch Port SecurityThe switch relies on the CAM table to forward data frames. When a data frame arrives at a switch port, the switch can obtain its source MAC address and record it in the CAM table. If a destination MAC address entry exists in the CAM table, the switch forwards the frame to the port corresponding to the MAC address specified in the CAM table. If the MAC address does not exist in the CAM table, the switch forwards the frame to every port except the port where the frame was received (i.e., unknown unicast frame flooding). However, the size of the CAM table is limited, and MAC flooding attacks take advantage of this limitation by using an attack tool to send a large number of invalid source MAC addresses to the switch until the switch CAM table is filled, an attack that causes the switch CAM table to overflow is called a MAC flooding attack. When the CAM table is filled, the switch floods the incoming traffic to all ports because it cannot find the port number corresponding to the destination MAC address in its own CAM table, and the switch actually acts like a hub.Configuring switch port security features can prevent MAC flooding attacks. Port security limits the number of valid MAC addresses allowed on a switch port or a specific MAC address. There are three main ways in which port security works as follows.1 Static: Only end devices with a specific MAC address are allowed to access the switch from this port. If static port security is configured, then when the source MAC address of a packet is not the statically specified MAC address, the switch will be penalized according to the penalty mode and the port will not forward these packets.2 Dynamic: Port security is achieved by limiting the number of MAC addresses that can access a switch port. By default, the switch allows only one MAC address per port to access the port.3Sticky: This is a combination of dynamic and static port security. The switch port acquires the MAC address of the end device by learning it dynamically and then saves the information in a running configuration file, which results in something like the static approach, except that instead of the MAC address being statically configured by the administrator, it is automatically learned by the switch. When the number of learned MAC addresses reaches.94.Cisco Networking Lab CCNA Lab Guide (Release 2)The switch does not learn them automatically when the number of learned MAC addresses reaches the port limit. Regardless of which of the above methods is used to configure port security. the end device attempting to access the port can be penalized in one of the following three modes when it violates.Protect: When a new end device is connected to the switch, if the MAC address entry of the port exceeds the maximum number or is different from the statically configured MAC address, this new end device will not be connected, while the original device is not affected and the switch does not send warning messages.Restrict: When a new end device accesses the switch, if the MAC address entry for that port exceeds the maximum number or is different from the statically configured MAC address, this new end device will not be accessible, while the original device is not affected, and the switch sends a warning message and increases the count of the violation counter.