Shutdown, Restrict or Protect?

About this interactive

From the lesson: - **Port security** limits how many MAC addresses a port may use, and which ones. It blunts MAC address flooding (an attacker filling the switch's MAC table so it floods like a hub) and stops extra devices on a port. - **Learning:** static (typed in), dynamic, or sticky (learned, then saved to the configuration). **Aging:** absolute or inactivity. - **Violation modes:** - **Shutdown** (the default): the port goes err-disabled and every device on it is cut off until an admin shuts and re-enables it. - **Restrict:** the violating MAC's frames are dropped, the counter increments and a syslog message and SNMP trap go out; the allowed devices keep working. - **Protect:** the violating frames are dropped silently, with no log and no counter. (The video says restrict drops all traffic on the port until it is back under its limit. It does not: like protect, it drops only the unknown device's frames.)

What you'll learn

Predict what each port security violation mode does when a port exceeds its MAC address limit: shutdown err-disables the port, restrict drops and reports the violating traffic, protect drops it silently
Explain how port security limits MAC addresses per port to blunt MAC address flooding and unauthorized devices

Aligned to

Cisco CCNA

5.7 Configure and verify Layer 2 security features

Key terms

Port Security: A Cisco switch feature that restricts which devices can connect to a port by limiting the number of allowed MAC addresses or requiring specific MAC addresses to be present. When a violation occurs, the port can be configured to shut down, restrict traffic, or send an alert.
Port Security Violation: A configurable response triggered when a port security rule is breached, with options including shutdown, restrict, or protect to control how the switch handles unauthorized MAC addresses.
Err-Disabled State: A Cisco switch port state where an interface is automatically shut down due to a detected error condition, such as an EtherChannel misconfiguration.
Sticky MAC Learning: A port security learning mode in which dynamically learned MAC addresses are written into the running configuration, making them persistent across reboots if the configuration is saved.
MAC Address Flooding: An attack in which an attacker overwhelms a switch's MAC address table with spoofed addresses, causing the switch to behave like a hub and broadcast traffic to all ports.
DHCP Starvation: An attack in which an attacker exhausts all available IP addresses in a DHCP pool by sending excessive requests, preventing legitimate devices from obtaining network configuration.

Topics

Port Security Violation Modes Mac Flooding Layer 2 Security Interactive Categorize

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →