Port-security with a two-MAC limit is on the lobby socket — how does a visitor still get on, and what does the violation mode cost?

## What port-security actually is Port-security is a local switchport feature. It caps how many source MAC addresses a port may learn, optionally pins them ("sticky" learning writes the learned addresses into the running configuration), and defines what the port does when the cap is exceeded. Everything it knows about a device is the source address in the frames it sends. That is the whole corrective, and it is the wrong answer a competent engineer gives: they treat a MAC limit as admission control for the lobby socket. It is not. It is a **counter with a consequence**. A MAC address is a value the endpoint's own software sets and can change in seconds; it is a claim, never an identity, and nothing in the frame proves the sender is the device that was originally there. ## How the visitor passes it The attack does not need tooling: 1. The room contains a device whose address is discoverable — an IP phone with the address printed on a label under it, a video codec that shows it on screen, a printer that prints its own configuration page. 2. The visitor unplugs that device (or plugs into the second socket, or into the phone's pass-through port) and sets their interface to the same address. 3. The switch sees a familiar address within the limit and forwards. Sticky learning narrows the window but does not close it. Sticky entries live in the running configuration; if they were never written to the saved configuration, a switch reload or a long port-down leaves the port ready to learn again — and the first device to send a frame becomes the pinned one. In a public room, first-to-speak is not a safe way to choose whom to trust. ## The violation modes are a choice about who pays | Mode | Behaviour | Who absorbs it | | --- | --- | --- | | protect | Offending frames dropped, no counter, no notification | You do — silently. The event is invisible, so it is never investigated | | restrict | Offending frames dropped, counters incremented, notification raised | The team that reads the notifications — real signal, plus noise from daisy-chained kit | | shutdown | Port disabled until an operator or an auto-recovery timer restores it | The room does. The phone, the video system and the desk on that port go down | Shutdown is the mode people pick because it sounds strongest, and it is the one that converts a nuisance into an outage anyone standing in the room can trigger. Worse, it needs an owner: someone has to re-enable the port, at whatever hour it happened, or an automatic recovery timer has to do it, which quietly turns the control back into a speed bump. Protect is the mode people pick to avoid outages, and it is the one that guarantees you never find out. Restrict is usually the right default because it preserves the record, but only if someone actually receives what it raises. ## The desk-side switch problem A MAC limit assumes one socket equals one device. Users defeat that with a five-port unmanaged switch under a desk, or an IP phone with a PC pass-through, or a docking station chained to a second dock. Each of these puts several addresses behind one switchport, so the limit has to be raised to two, three or five — and at that point the control is no longer distinguishing a legitimate fan-out from a visitor plugged in alongside it. The physical estate quietly outgrew the model the control depends on. ## Where it still earns its place None of this makes port-security worthless. On a stable single-device port it raises the effort required, it produces a record when something changes, and it constrains the crude case of an extra device appearing. What it must not be sold as is admission control for a public room: it authenticates nothing, and its strongest mode gives the person in the room a switch to turn the room's own services off. If you need a socket in a public place to admit only devices you trust, the decision has to be made by something that checks a credential, not by something that counts addresses. ## What an interviewer is listening for The direction of the claim — a MAC address is asserted, not verified — and an honest account of the violation-mode trade-off framed as who absorbs the cost. Naming the sticky-learning reload case and the desk-switch fan-out separates a candidate who has configured this from one who has read about it.