MAC Spoofing Risk Calculator
Assess MAC spoofing and CAM table flooding exposure from port security coverage, 802.1X adoption and MAC table headroom.
About MAC Spoofing Risk Calculator
Port security and 802.1X are weighted equally because either one defeats casual MAC spoofing, and a tight per-port MAC limit adds a small bonus. Separately, the time-to-overflow figure shows how quickly an attacker can fill the CAM table and force the switch to flood every frame, which converts a switched network back into a hub. Once the MAC table overflows the switch floods unknown unicast out every port, so an attacker on any access port passively sees traffic destined for every other host in the VLAN.
Formula
MAC Spoofing Risk
risk = 100 − (0.45·port security coverage + 0.45·802.1X coverage + 10 ÷ MACs allowed per port); overflow time = free MAC table entries ÷ flood rate.
- port security
- Sticky or static MAC limits configured on the access port
- 802.1X
- Port-based network access control with an identity backend
- flood rate
- Forged MAC addresses per second an attacker can inject
Worked example
With the default values below, MAC Spoofing Risk Calculator returns MAC Spoofing Risk Score of 50.0. Change any input above and every figure here is recalculated in your browser.
Inputs used
- Access ports in scopeaccepts 1–100,000 ports
- 480 ports
- Ports with port security configuredaccepts 0–100,000 ports
- 300 ports
- Ports with 802.1X authenticationaccepts 0–100,000 ports
- 180 ports
- Maximum MAC addresses permitted per portaccepts 1–256 addresses
- 2 addresses
- Switch MAC address table sizeaccepts 128–1,000,000 entries
- 32,000 entries
- MAC addresses currently learnedaccepts 0–1,000,000 entries
- 5,200 entries
- MAC flood rate an attacker can generateaccepts 1–10,000,000 MAC/s
- 1,000 MAC/s
Results
- MAC Spoofing Risk Score
- 50.0 /100
- Risk Band
- Medium
- Port Security Coverage
- 62.5%
- 802.1X Coverage
- 37.5%
- Ports With No Layer 2 Control
- 180
- MAC Table Utilisation
- 16.25%
- Time to Overflow the MAC Table
- 26.8 seconds
Step by step
- 1Values used
- 2MAC Spoofing Risk
- 3MAC Spoofing Risk Score= 50.0 /100
- 4Risk Band= Medium
- 5Port Security Coverage= 62.5
- 6802.1X Coverage= 37.5
- 7Ports With No Layer 2 Control= 180
- 8MAC Table Utilisation= 16.25
Assumptions and limits
- The result is derived only from the 7 inputs listed above. Anything not among them is not part of the calculation.
- In particular, this calculator does not take inflation, tax, fees or charges or compounding frequency into account.
- Figures are rounded for display to 2 decimal places, so totals built from several rounded parts can differ slightly from the unrounded arithmetic.
How these calculators are built and tested is described on the Methodology page. If a figure looks wrong, please report it.
Frequently Asked Questions
How is MAC Spoofing Risk calculated?
risk = 100 − (0.45·port security coverage + 0.45·802.1X coverage + 10 ÷ MACs allowed per port); overflow time = free MAC table entries ÷ flood rate. Port security and 802.1X are weighted equally because either one defeats casual MAC spoofing, and a tight per-port MAC limit adds a small bonus. Separately, the time-to-overflow figure shows how quickly an attacker can fill the CAM table and force the switch to flood every frame, which converts a switched network back into a hub.
Why does MAC Spoofing Risk matter?
Once the MAC table overflows the switch floods unknown unicast out every port, so an attacker on any access port passively sees traffic destined for every other host in the VLAN.
What values do I need to enter?
This calculator takes 7 inputs: Access ports in scope, Ports with port security configured, Ports with 802.1X authentication, Maximum MAC addresses permitted per port, Switch MAC address table size, MAC addresses currently learned, MAC flood rate an attacker can generate. The pre-filled defaults are a realistic starting point — replace them with figures from your own environment for a result you can act on.
Is 802.1X worth it if I already have port security?
Yes. Port security binds a port to a MAC address, and a MAC address is trivially forged by reading it off a label or a packet capture. 802.1X authenticates a credential — a certificate or machine account — which cannot be cloned from observing the wire. Port security is a speed bump; 802.1X is a control.