MAC flooding
Send thousands of fake MAC addresses to a switch — the CAM table fills up, the switch falls back to broadcast mode.
The switch starts acting as a hub → the attacker can sniff all traffic. Defences: port security (max N MACs per port), 802.1X, DHCP snooping. A classic LAN attack from the macof tool (late 90s, still works against unprotected switches).