6.5.1

Standard switches and VLANs can protect against the following types of attacks.
MAC flooding Floods a switch with packets that contain MAC addresses tagged as having
come from different sources. Many switches use a content-addressable
memory table to learn and store the source address for each packet. When
the table is full, the switch can enter a fully open state in which every
incoming packet is broadcast on all ports, letting the attacker see all of the
switch’s traffic. This state might result in packet leakage across VLANs.
Although VMware standard switches store a MAC address table, they do
not get the MAC addresses from observable traffic and are not vulnerable
to this type of attack.
802.1q and ISL tagging
attacks
Force a switch to redirect frames from one VLAN to another by tricking the
switch into acting as a trunk and broadcasting the traffic to other VLANs.
VMware standard switches do not perform the dynamic trunking required
for this type of attack and, therefore, are not vulnerable.
Double-encapsulation
attacks
Occur when an attacker creates a double-encapsulated packet in which the
VLAN identifier in the inner tag is different from the VLAN identifier in the
outer tag. For backward compatibility, native VLANs strip the outer tag from
transmitted packets unless configured to do otherwise. When a native
VLAN switch strips the outer tag, only the inner tag is left, and that inner tag
routes the packet to a different VLAN than the one identified in the now-
missing outer tag.
VMware standard switches drop any double-encapsulated frames that a
virtual machine attempts to send on a port configured for a specific VLAN.
Therefore, they are not vulnerable to this type of attack.
Multicast brute-force
attacks
Involve sending large numbers of multicast frames to a known VLAN
almost simultaneously to overload the switch so that it mistakenly allows
some of the frames to broadcast to other VLANs.
VMware standard switches do not allow frames to leave their correct
broadcast domain (VLAN) and are not vulnerable to this type of attack.
vSphere Security
VMware, Inc. 184