in this topology, when I change MAC address on attacker NIC to PC2s MAC, where is running webserver, then ex. icmp attacker -> PC1, so in switch CAM is on Fa0/3 same MAC as on Fa0/2 I think so...? Now, when PC1 open browser and send HTTP GET, the frame will get on both, Attacker and PC2?

Attacker and PC2 have same MAC, when PC1 communicates, switch will send frame to both interfaces?


1 Answer 1


MAC address spoofing is more about network disruption than about stealing information.

A switch can only have a single MAC address table entry for each MAC address. The attacker will not get every frame destined for its attack target. As frames come into the switch from both the attacker and the target, the MAC address table will flap. Some frames will go to the attacker, and some will go to the original target. Some switches will recognize the flapping, and you can mitigate it.

  • So it depends who will send last frame(PC1/attacker), then reply, from PC2 will be delievered to port with that entry?
    – S1krzt
    Nov 21, 2016 at 16:44
  • Yes. The last host to send a frame to the switch will the source MAC address that is being spoofed will get the frames destined for that MAC address. Both the attacker and the target host will be sending frames, and the switch will be constantly changing its MAC address table.
    – Ron Maupin
    Nov 21, 2016 at 16:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.