A CAM table stores network MAC addresses and port mappings so a switch can forward traffic to the correct device quickly. Technically, it is a hardware-assisted lookup table used in Layer 2 switching, where entries age out, update on topology change, and can be stressed by spoofing or flooding attacks.
What a CAM table does in a switch
A CAM table is the switch’s fast path for Layer 2 forwarding. It learns which MAC address is associated with which port, so frames can be delivered without flooding the whole segment, and entries update as devices move or topology changes.
The table is usually maintained in hardware or closely coupled silicon, which is why it can look up destinations much faster than a generic software list. That speed is a core reason switching scales well in busy local networks.
Why CAM tables matter to network performance
CAM tables are one of the mechanisms that lets a switch act intelligently instead of blindly repeating traffic. When the table has a valid MAC-to-port mapping, the switch can forward unicast frames only where they belong, reducing unnecessary traffic and improving latency.
That efficiency also creates dependency: the accuracy of the table directly affects forwarding quality. If the table is incomplete, stale, or under stress, the switch may fall back to flooding unknown destinations, which increases noise and can expose traffic patterns to unintended ports.
How CAM tables are populated and aged
Entries are learned from observed source MAC addresses and associated ingress ports, then refreshed when the same device is seen again. Aging keeps the table from filling with obsolete mappings, which is important in networks where endpoints move, reboot, or disconnect frequently.
Because CAM is dynamic, it reflects live network conditions rather than static configuration alone. That makes it useful for operational forwarding, but also means the table depends on normal traffic to stay accurate and on aging logic to clear entries that are no longer valid.
CAM table stress and attack surface
CAM tables can be stressed by spoofing or flooding, especially when an attacker tries to overwhelm learning capacity or manipulate what the switch believes is attached to a port. The result is not usually a full compromise of the switch, but degraded forwarding behavior that can make the network noisier and less predictable.
Hardware lookup tables are finite, so excessive churn or a crafted burst of fake source addresses can reduce the value of normal MAC learning. In practice, the concern is less about the table itself as a data structure and more about the forwarding trust it creates across the Layer 2 segment.
Risk and Threat Considerations
A stressed or poisoned CAM table can turn a normally efficient switch into a broader exposure point. When forwarding state becomes unreliable, traffic may be flooded more often than intended, which increases visibility of local traffic and can make reconnaissance, sniffing, or lateral movement easier on shared segments.
Failure mechanism: Excessive MAC learning, spoofed source addresses, or rapid topology churn can fill or destabilize the table, forcing fallback behavior such as unknown-unicast flooding or incorrect port association.
Impact: The network can experience reduced performance, traffic leakage across ports, and weaker containment at Layer 2, especially if the attacker can sustain the pressure long enough to affect normal forwarding behavior.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0, NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST CSF 2.0 | PR.PS-05 — Resilience of Technology Infrastructure | CAM forwarding stability supports resilient local-network operations. |
| Recommendation — Harden switch access and monitor for abnormal forwarding-state instability. | ||
| NIST SP 800-53 Rev 5 | SC-7 — Boundary Protection | CAM tables help enforce Layer 2 traffic boundaries and segmentation behavior. |
| AU-6 — Audit Record Review, Analysis, and Reporting | Switch logs and MAC-learning events help detect flooding or spoofing conditions affecting CAM tables. | |
| Recommendation — Use boundary controls to limit lateral traffic when Layer 2 forwarding degrades. Review switch logs for anomalous MAC churn and flooding indicators. | ||
| CIS Controls v8 | CIS-12 — Network Infrastructure Management | CAM tables are part of switch behavior that needs secure configuration and monitoring. |
| Recommendation — Track switch configuration and alert on unusual Layer 2 forwarding behavior. | ||
| MITRE ATT&CK | T1095 — Non-Application Layer Protocol | CAM stress often relies on abuse of Layer 2 traffic patterns and spoofed Ethernet behavior. |
| Recommendation — Map suspicious Layer 2 flooding or spoofing to network-protocol abuse techniques. | ||
Practitioner Guidance
What to watch for: Treat unusually high MAC churn, sudden increases in unknown unicast flooding, and port patterns that do not match expected endpoint density as signs worth investigating. Those indicators often point to misconfiguration, loop conditions, or deliberate table stress.
Governance implication: Switch forwarding state should be managed as part of network hygiene, not assumed to be self-correcting. Operational teams should understand how aging, port security, and segmentation controls interact so the table remains a reliable forwarding aid rather than a single point of Layer 2 fragility.
Related resources from NHI Mgmt Group
- What happens when one agent writes poisoned content into a shared memory store?
- How should security teams handle AI agent memory so poisoned content does not survive across sessions?
- Why do attackers often check model availability before trying to generate content?
- What is the difference between content inspection and identity-aware data protection?
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 23, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org