Assess MAC spoofing and CAM table flooding exposure from port security coverage, 802.1X adoption and MAC table headroom.
Port security and 802.1X are weighted equally because either one defeats casual MAC spoofing, and a tight per-port MAC limit adds a small bonus. Separately, the time-to-overflow figure shows how quickly an attacker can fill the CAM table and force the switch to flood every frame, which converts a switched network back into a hub. Once the MAC table overflows the switch floods unknown unicast out every port, so an attacker on any access port passively sees traffic destined for every other host in the VLAN.
MAC Spoofing Risk
risk = 100 − (0.45·port security coverage + 0.45·802.1X coverage + 10 ÷ MACs allowed per port); overflow time = free MAC table entries ÷ flood rate.
risk = 100 − (0.45·port security coverage + 0.45·802.1X coverage + 10 ÷ MACs allowed per port); overflow time = free MAC table entries ÷ flood rate. Port security and 802.1X are weighted equally because either one defeats casual MAC spoofing, and a tight per-port MAC limit adds a small bonus. Separately, the time-to-overflow figure shows how quickly an attacker can fill the CAM table and force the switch to flood every frame, which converts a switched network back into a hub.
Once the MAC table overflows the switch floods unknown unicast out every port, so an attacker on any access port passively sees traffic destined for every other host in the VLAN.
This calculator takes 7 inputs: Access ports in scope, Ports with port security configured, Ports with 802.1X authentication, Maximum MAC addresses permitted per port, Switch MAC address table size, MAC addresses currently learned, MAC flood rate an attacker can generate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Yes. Port security binds a port to a MAC address, and a MAC address is trivially forged by reading it off a label or a packet capture. 802.1X authenticates a credential — a certificate or machine account — which cannot be cloned from observing the wire. Port security is a speed bump; 802.1X is a control.