Why Port Security?

Port security allows network admins to control which devices are allowed to access the network.

However, MAC address spoofing is a simple task.

• It's easy to configure a device to send frames with a different source MAC address.

Rather than manually specifying the MAC addresses allowed on each port, port security's ability to limit the number of MAC addresses allowed on an interface is more useful.

Think of the DHCP starvation attack.

• the attacker can spoof thousands of fake MAC addresses.

• the DHCP server will assign IP addresses to these fake MAC addresses, exhausting the DHCP pool.

• the switch's MA address table can also become full due to such an attack.

Limiting the number of MAC addresses on an interface can protect against those attacks.