An attacker sends unsolicited ARP replies onto the network in order to redirect traffic that is sent to valid hosts.
An attacker sends thousands of frames with spoofed MAC addresses, in an attempt to fill the CAM table of the switch.
An attacker takes advantage of the default DTP settings on switch ports in order to negotiate a trunk link with a switch.
An attacker attempts to spoof the IP address of packets so that the switch will believe the packets are from a different host.