A router protects the edge, but inside the LAN a switch trusts every frame. A laptop in the lobby, or a compromised PC, can attack the people around it. The CCNA expects you to know each attack and its counter-measure:
| Attack | What the attacker does | Mitigation |
|---|---|---|
| MAC flooding | Floods the switch with fake source MACs until the MAC table fills; the switch then floods every frame, so the attacker sees other people's traffic | Port security |
| Rogue DHCP | Runs a fake DHCP server to hand out its own address as the gateway (man-in-the-middle) | DHCP snooping |
| ARP poisoning / spoofing | Sends fake ARP replies so victims send their traffic to the attacker | Dynamic ARP inspection (DAI) |
| Address spoofing | Fakes a source IP or MAC | IP source guard, DAI, port security |
| VLAN hopping | Reaches another VLAN by double-tagging or by forming a trunk | No DTP on access ports, change the native VLAN, prune trunks |
| STP manipulation | Pretends to be the root bridge to reroute traffic | BPDU guard and root guard |
| Rogue IPv6 router | Sends Router Advertisements so hosts use the attacker as their IPv6 gateway | RA guard |
This module covers port security, DHCP snooping, DAI, storm control and RA guard. VLAN-hopping defences (access ports with switchport mode access, a changed native VLAN) you met with VLANs; BPDU guard and root guard you met with spanning tree.
Remember: Rogue DHCP → DHCP snooping. ARP poisoning → DAI. MAC flooding → port security. Fake STP root → BPDU/root guard. Fake IPv6 router → RA guard.