What is MAC Flooding?

Flooding is a data flow transfer technology used by switches and bridges to send data flows received from an interface to all interfaces except the interface.

Generation of broadcast frames: The existence of broadcast frames in the network is inevitable. For example, when the DHCP server is turned on, every request will appear in the frame format "FF.FF.FF.FF.FF.FF.FF". Port forwarding. Assume that host A and B are in the same network. When host A wants to send information to host B, it needs to know the IP address and MAC address of host B. Here we assume that A only knows the IP address of B, but not Knowing the MAC address of B, then A needs to send an ARP request to the network to obtain the MAC address of B. This ARP request is actually a broadcast packet.

The flood is related to the MAC list. It exists in the cache and has a certain MAC address. Only when the specific forwarding port and MAC pairing cannot be found in the MAC table, flood processing is started, but the flood is not a broadcast frame (FF.FF.FF.FF.FF.FF). Broadcasting has a specific behavior, which is targeted at the entire network. In ARP, a specific host is often required to respond. Of course, too many broadcasts are harmful to the network and easily cause broadcast storms. In general, there are two main differences:

Flood operations broadcast ordinary data frames instead of broadcast frames.

Broadcast is to send messages to all ports (including its own port) in the same subnet; flooding only sends messages to all ports (excluding its own port).