Macof – MAC address flooding

The “CCIE Enterprise Infrastructure – Host VM” includes a set of tools which can be useful to verify the correct implementation of certain features on the switch (e.g. Port-security, etc.)

The macof is a member of the Dsniff suit toolset. It is used to flood the switch on a local network with MAC addresses.

Macof Tool Options

Below are the options offered by the Macof tool.

$ macof [-i interface] [-s src] [-d dst] [-e tha] [-x sport] [-y dport] [-n times]

Details of every option of the tool:

-i interface Specify the interface to send on.
-s src Specify source IP address.
-d dst Specify destination IP address.
-e Specify target hardware address.
-x sport Specify TCP source port.
-y dport Specify TCP destination port.
-n times Specify the number of packets to send.

Environment

The tests are done using EVE-NG running two Switches (vios_l2-adventerprisek9-m) and two CCIE EI VM Hosts in VLAN 3010 (10.0.10.0/24).

Testing

So what’s the content of the MAC address table before doing any tests? We only see the two hosts and the neighbor switch.

SW2#sh mac address-table vlan 3010
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
3010    5000.0001.0000    DYNAMIC     Gi0/0 <-- ccie_host1
3010    5000.0002.0000    DYNAMIC     Gi0/1 <-- ccie_host2
3010    5000.0003.0000    DYNAMIC     Gi0/0 <-- neighbor switch
Total Mac Addresses for this criterion: 3

Lets go ahead and send 2 packets with the command sudo macof -i ens3 -n 2 (or sudo -s and then macof -i ens3 -n 2)

And now lets look at the MAC address table of the switch SW2:

SW2#sh mac address-table vlan 3010
          Mac Address Table
-------------------------------------------

Vlan    Mac Address       Type        Ports
----    -----------       --------    -----
3010    32df.5a11.ba49    DYNAMIC     Gi0/1
3010    5000.0001.0000    DYNAMIC     Gi0/0
3010    5000.0002.0000    DYNAMIC     Gi0/1
3010    5000.0003.0000    DYNAMIC     Gi0/0
3010    f439.fd2c.d92b    DYNAMIC     Gi0/1
Total Mac Addresses for this criterion: 5

As we can see the two MAC addresses have been added to the table. Success 🙂

Issues

During the tests I noticed that not all addresses generated by the tool show up in the MAC address table of the switch. In the below example I sent 10 packets, expecting the counter to increase by, well, 10.

Before starting the flood (sudo macof -i en3 -n 10) we can see 3 MAC addresses in the table.

SW2#sh mac address-table count vlan 3010

Mac Entries for Vlan 3010:
---------------------------
Dynamic Address Count  : 3
Static  Address Count  : 0
Total Mac Addresses    : 3

Total Mac Address Space Available: -2064686574

After the command has been executed we see 6 MAC addresses in total, which means that we’ve only added three addresses to the table.

SW2#sh mac address-table count vlan 3010

Mac Entries for Vlan 3010:
---------------------------
Dynamic Address Count  : 6
Static  Address Count  : 0
Total Mac Addresses    : 6

Total Mac Address Space Available: -2064686574

And what’s the problem? If you look at the MAC addresses (source- & destination-MAC) generated during the test, you’ll see that not all of them are valid. The second line for example reads 93:8c:ea:0:d7:1a , when in fact it should be 93:8c:ea:0X:d7:1a or 93:8c:ea:X0:d7:1a (X being a value from 0-9, a-f). As we can see there is a value missing in the 4th octet and therefore the address is invalid.

So what’s the takeway? Don’t trust your tools blindly.