312-50 Question 181
Single answer▪ Sniffing ConceptsDuring an internal security assessment, you connect a laptop running Wireshark to an unused switch port in a company's office network. The network uses modern managed switches with no port mirroring configured. You can capture only broadcast traffic and frames sent to or from your own NIC, but you are unable to see other users' unicast traffic. The client asks for the most appropriate way to legitimately capture a specific employee workstation's traffic for troubleshooting and security validation without disrupting the network. Which action should you recommend?
- A
Enable promiscuous mode in Wireshark so the NIC will capture all switch traffic on that VLAN
- B
Configure a SPAN/port-mirroring session on the switch to copy the target workstation's traffic to the assessment laptop's port
- C
Send gratuitous ARP replies to all hosts so their traffic is flooded to the assessment laptop
- D
Place the switch into half-duplex mode so all frames become visible to any sniffer on the segment
Show answer and explanation
Correct answer: B
Explanation
In a switched Ethernet environment, passive sniffing from a normal access port typically captures broadcasts, multicasts as permitted, and traffic to or from the local machine. Unicast traffic between other hosts is not ordinarily visible because the switch forwards frames based on its MAC address table. For an authorized assessment or troubleshooting task, the correct approach is to use a network TAP or, more commonly on managed switches, a SPAN/port-mirroring session to replicate the target traffic to the analyst's port. This aligns with vendor best practices for packet analysis on switched networks. By contrast, promiscuous mode only affects what the local NIC accepts after traffic reaches that port; it does not cause the switch to send all traffic there. ARP spoofing can be used by attackers to intercept traffic on local networks, but it is intrusive and not the recommended administrative method for legitimate capture. This distinction between passive sniffing, switched network limitations, and active interception techniques is a core CEH sniffing concept.
- A. Incorrect.
Incorrect. Promiscuous mode allows a NIC and packet capture software to accept frames not addressed to the local MAC address, but it does not override normal switched Ethernet behavior. On a switch, unicast frames are forwarded only to the destination port unless features such as port mirroring, TAPs, or certain attack techniques are used. A common misconception is that promiscuous mode alone lets a sniffer see all traffic on a switched network, which was more feasible on shared-media hubs.
- B. Correct.
Correct. On a managed switch, the standard and non-disruptive method to observe another host's traffic is to configure SPAN (Switched Port Analyzer) or port mirroring. This copies ingress, egress, or both directions of the target port or VLAN to the analyzer port where Wireshark is connected. This is a legitimate troubleshooting and monitoring approach commonly supported by enterprise switches from vendors such as Cisco and others.
- C. Incorrect.
Incorrect. Gratuitous ARP can update ARP caches, but using forged ARP replies to redirect traffic is an ARP spoofing/poisoning attack, not the most appropriate legitimate recommendation for a client-approved capture. It can introduce instability, trigger security controls such as Dynamic ARP Inspection, and affect host communications. While ARP poisoning is relevant in sniffing concepts, it is not the best answer when the goal is controlled, authorized capture without disruption.
- D. Incorrect.
Incorrect. Changing duplex settings does not make switched traffic visible to all ports. Half-duplex affects collision handling and link negotiation behavior, not the switch's MAC address table forwarding logic. This distractor reflects confusion between legacy shared Ethernet concepts and modern switched networks.