Port Security and Port-Level Protections

Port security

is a capability that allows you to limit the number of MAC addresses that can be used on a single port. This prevents a number of possible problems, including MAC (hardware) address spoofing, content-addressable memory (CAM) table overflows, and in some cases, plugging in additional network devices to extend the network

Loop prevention

focuses on detecting loops and then disabling ports to prevent the loops from causing issues. Spanning Tree Protocol (STP), using bridge protocol data units, as well as anti-loop implementations like Cisco’s loopback detection capability, sends frames with a switch identifier that the switch then monitors to prevent loops

Broadcast storm prevention

sometimes called storm control, prevents broadcast packets from being amplified as they traverse a network

Bridge protocol data unit (BPDU) guard

protects STP by preventing ports that should not send BPDU messages from sending them. It is typically applied to switch ports where user devices and servers will be plugged in

Dynamic Host Configuration Protocol (DHCP) snooping

focuses on preventing rouge DHCP servers from handing out IP addresses to clients in a managed network