What would happen if you have an access layer switch with a 10 Gbps uplink and 1 Gbps downlinks and 1 machine (behind one of the 1 Gbps ports) would be attacked by a 10 Gbps UDP flood type attack? Will the switch accept the whole 10 Gbps of traffic and pass only 1 Gbps to the downlink and have its uplink saturated or only let 1 Gbps pass through, so that the uplink isn't congested (10% used)? I'm trying to find out what would happen in case a 10 Gbps network attack targets one machine connected at 1 Gbps to a switch having a 10 Gbps uplink. Thanks.
In a typical scenario, the switch has no way to tell the upstream device to stop sending it so much. So it will receive 10Gbps from upstream. Obviously it can only send 1Gbps downstream. So it will send 1Gbps downstream. Of the remaining 9Gbps, a few packets will probably be buffered and the rest will be dropped by the switch.
The switch will accept up to the interface speed from an interface*. Switches have very tiny buffers. With 10 Gbps of traffic going to a 1 Gbps interface, 90% of the traffic will be dropped at the 1 Gbps interface.
*There are cases where this may not be possible. For example, a switch with an ASIC that serves an interface, but the ASIC can't handle the full traffic.