Describe port security on switches and how it helps prevent MAC spoofing.

• A. Port security increases allowed traffic speed to deter spoofing.
• B. Port security limits number of MAC addresses per port and can block frames from unknown or spoofed addresses; helps prevent MAC spoofing and ARP poisoning on access ports.
• C. Port security is only about IP filtering.
• D. Port security disables VLANs.

Answer: (B)

Port security on switches binds one or more MAC addresses to a specific port and enforces rules about which devices can send frames on that port. The key benefit is that it limits how many distinct MAC addresses can be learned on the port and can block frames from unknown or spoofed addresses. This directly counters MAC spoofing because if a device tries to send frames with a MAC that isn’t allowed (or if a new MAC would exceed the limit), those frames are dropped or the port is shut down, depending on the configuration. You can configure static MACs so only particular devices are permitted, or allow dynamic (sticky) learning with aging to populate the allowed set. This approach is especially effective on access ports, where end devices connect, and it also helps mitigate ARP poisoning because spoofed MACs won’t be accepted as legitimate sources on that port.