macof.py is a MAC address table overflow utility.
The traditional tool for MAC table overflow attacks is
macof from the
However I was not satisfied with this tool.
macofhas no rate limit mechanism, it sends the packets as fast as the local CPU and the network adapter can support it.
This leaves no room for a proper interception of users data.
Half of the packets generated by
macofviolates the Ethernet protocol by having the multicast bit set on the sender’s MAC address.
As a result, these packets are considered corrupted and silently dropped by the first encountered switch.
In other words, half of the packets generated by
macofare generated for nothing.
macofconstantly uses random MAC addresses for generated packets, meaning that a given source MAC address is rarely used more than once.
This means that switches’ MAC table aging system will regularly clean the table from all malicious entries. Of course, the table will fill up again in a few seconds, but these seconds may be enough for the switch to learn a few more legitimate addresses. As a result data destined to these addresses won’t be broad-casted anymore.
In other words the interception process is, here again, unreliable.
Most of these issues are probably due to the fact that this tool is now quite old and seemingly unmaintained (last update in 2000).
I therefore decided to implement my own version,
macof.py, compatible with
most options from dsniff’s
macof.pyallows to tune the frame emission rate to minimize the impact on the attacker’s host and the network resources as much as possible.
This offers a more reliable propagation of the forged MAC addresses throughout the switched network and a more efficient interception of broadcast data.
macof.pysends only valid frames, effectively updating switches MAC address tables.
macof.pyfirst locally pre-generates a certain amount of Ethernet frames, each with a unique random source MAC address, and then replays this same set of frames in loop for all the attack duration.
This effectively simulate genuine devices activity, forcing the switches to regularly reset the associated aging-timers, keeping their MAC address table filled without interruption.
macof.py functionalities can be easily included in larger Python projects.
macof.py is freely available (GPL v3).
Latest news on the project can be found on the project’s main page.
macof.py and its accompanying man page can be installed system-wide using the
install -m 755 -D -t /usr/local/bin ./macof.py mkdir -p /usr/local/share/man/man1 gzip -c ./macof.py.1 >/usr/local/share/man/man1/macof.py.1.gz
macof.py(1) man page describes
macof.pyusage and options. It also provides advices and examples covering the most common use-cases.
You can also read this practical use-case, part of a series on network layer 2 exploitation and protection.
Please send bug reports to the macof.py issues page on GitHub.