What it actually restricts
Recall from Ethernet Frame & MAC Addressing that a switch learns a MAC (Media Access Control) address for whatever port it sees that address arrive on. Nothing stops someone from plugging an unauthorized laptop into an open conference-room jack, or worse, plugging in a cheap unmanaged hub to fan one jack out to several devices. Port security caps how many MAC addresses a single port is allowed to learn, like a keycard reader that locks the door the moment a sixth unrecognized badge tries to swipe through, when only five badges were ever supposed to exist for that door.
How addresses get allowed onto a port
- Static: the administrator manually types in the exact MAC address(es) permitted on the port.
- Dynamic: the switch learns whatever MAC address(es) show up first, up to the configured maximum, but forgets them on reboot.
- Sticky: the switch learns them dynamically, the same as above, but then saves them into the running configuration so they survive a reboot without retyping anything.
What happens on a violation
If a port is already at its MAC limit and a new, unrecognized address shows up, one of three violation modes decides what happens next:
| Mode | What happens |
|---|---|
| Protect | Silently drops traffic from the offending MAC. No log, no counter. |
| Restrict | Drops the traffic, but also logs it and increments a violation counter. |
| Shutdown (default) | Puts the entire port into err-disabled state. It stops passing any traffic at all until an administrator manually re-enables it. |
Port security is also the first line of defense against MAC flooding: an attacker deliberately sending frames from thousands of fake source MACs to overflow a switch's MAC table, forcing it to fail open and flood everything like a hub. Capping learned addresses per port stops that flood at the one port it's coming from.