Detecting MAC Flooding Attacks Against Open vSwitch Networks Through MAC Table Anomaly Monitoring

Enterprise networks use Layer 2 switching infrastructure to forward Ethernet frames between connected endpoints. A switch maintains a MAC address table that associates learned MAC addresses with network interfaces.

Open vSwitch (OVS) is deployed as the controlled virtual network-switching infrastructure in an isolated Ubuntu-based enterprise laboratory.

A MAC Flooding Attack attempts to overwhelm the switch's MAC address table with a large number of generated source MAC addresses. When the MAC table becomes unable to maintain normal address-learning behavior, the switch may experience abnormal forwarding behavior.

In this use case, the MAC Flooding attack is simulated against an isolated Open vSwitch environment using macof from Kali Linux.

The Open vSwitch MAC address table and forwarding behavior are monitored before, during, and after the controlled attack.

The security assessment focuses on identifying abnormal growth in learned MAC addresses and determining whether the network infrastructure can detect MAC Flooding activity.

After implementing the defensive monitoring controls, the MAC Flooding assessment is repeated to verify that abnormal MAC-learning behavior is detected while legitimate endpoint communication continues to operate normally.

Open vSwitch provides Layer 2 virtual switching functionality for the controlled enterprise-style network. The switch dynamically learns source MAC addresses and maintains them in its MAC address table to determine where Ethernet traffic should be forwarded.

A MAC Flooding attack generates a large number of Ethernet frames with different source MAC addresses. The attacker attempts to cause abnormal growth in the switch's learned MAC address table.

The security problem can occur when excessive unique source MAC addresses are generated, MAC address learning increases abnormally, a single endpoint generates an unusual number of source MAC addresses, MAC address-table changes are not monitored, Layer 2 network activity is not baselined, network administrators cannot identify abnormal MAC-learning behavior, or network security monitoring does not correlate endpoint behavior with switch-table changes.

The security problem is therefore:

The proposed solution introduces MAC address-table monitoring, endpoint behavior analysis, network baselining, abnormal MAC-learning detection, interface-level anomaly detection, rate-based monitoring, network segmentation, and security event logging.

The attacker generates a large number of Ethernet frames using different source MAC addresses. The controlled Open vSwitch environment receives these frames and attempts to learn the generated MAC addresses. The security assessment observes the resulting MAC-table behavior and determines whether abnormal MAC-learning activity can be identified.

The assessment focuses on abnormally high numbers of learned MAC addresses, rapid MAC-address table changes, large numbers of unique source MAC addresses, unusual MAC-learning activity from a single interface, and changes from the established network baseline.

A Layer 2 switch should maintain an expected baseline of MAC-address learning behavior for connected endpoints.

The security monitoring process establishes normal MAC-learning activity and detects significant deviations. The assessment considers learned MAC addresses, MAC-table growth, unique source MAC addresses, network interfaces, Ethernet traffic, and changes from the established Layer 2 baseline.

The secure processing flow is: