MAC Spoofing Risk Calculator
Assess MAC spoofing and CAM table flooding exposure from port security coverage, 802.1X adoption and MAC table headroom.
Inputs
MAC Spoofing Risk Score
50.0/100
Risk Band
Medium
Port Security Coverage
62.5%
802.1X Coverage
37.5%
Ports With No Layer 2 Control
180
MAC Table Utilisation
16.25%
Time to Overflow the MAC Table
26.8seconds
Step by step
Values used
Access ports in scope = 480 ports; Ports with port security configured = 300 ports; Ports with 802.1X authentication = 180 ports; Maximum MAC addresses permitted per port = 2 addresses; Switch MAC address table size = 32,000 entries; MAC addresses currently learned = 5,200 entries; MAC flood rate an attacker can generate = 1,000 MAC/s
MAC Spoofing Risk
risk = 100 − (0.45·port security coverage + 0.45·802.1X coverage + 10 ÷ MACs allowed per port); overflow time = free MAC table entries ÷ flood rate.
MAC Spoofing Risk Score
= 50.0 /100
Risk Band
= Medium
Port Security Coverage
= 62.5
802.1X Coverage
= 37.5
Ports With No Layer 2 Control
= 180
MAC Table Utilisation
= 16.25
How it works
Port security and 802.1X are weighted equally because either one defeats casual MAC spoofing, and a tight per-port MAC limit adds a small bonus. Separately, the time-to-overflow figure shows how quickly an attacker can fill the CAM table and force the switch to flood every frame, which converts a switched network back into a hub. Once the MAC table overflows the switch floods unknown unicast out every port, so an attacker on any access port passively sees traffic destined for every other host in the VLAN.
Formula
MAC Spoofing Risk
risk = 100 − (0.45·port security coverage + 0.45·802.1X coverage + 10 ÷ MACs allowed per port); overflow time = free MAC table entries ÷ flood rate.
- port security
- Sticky or static MAC limits configured on the access port
- 802.1X
- Port-based network access control with an identity backend
- flood rate
- Forged MAC addresses per second an attacker can inject
Frequently Asked Questions
How is MAC Spoofing Risk calculated?
risk = 100 − (0.45·port security coverage + 0.45·802.1X coverage + 10 ÷ MACs allowed per port); overflow time = free MAC table entries ÷ flood rate. Port security and 802.1X are weighted equally because either one defeats casual MAC spoofing, and a tight per-port MAC limit adds a small bonus. Separately, the time-to-overflow figure shows how quickly an attacker can fill the CAM table and force the switch to flood every frame, which converts a switched network back into a hub.
Why does MAC Spoofing Risk matter?
Once the MAC table overflows the switch floods unknown unicast out every port, so an attacker on any access port passively sees traffic destined for every other host in the VLAN.
What values do I need to enter?
This calculator takes 7 inputs: Access ports in scope, Ports with port security configured, Ports with 802.1X authentication, Maximum MAC addresses permitted per port, Switch MAC address table size, MAC addresses currently learned, MAC flood rate an attacker can generate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Is 802.1X worth it if I already have port security?
Yes. Port security binds a port to a MAC address, and a MAC address is trivially forged by reading it off a label or a packet capture. 802.1X authenticates a credential — a certificate or machine account — which cannot be cloned from observing the wire. Port security is a speed bump; 802.1X is a control.