312-50 Question 182
Single answer▪ Sniffing ConceptsDuring an authorized internal assessment, you connect a laptop running Wireshark to an unused switch port in the finance department. The network uses modern managed switches with no SPAN/mirror session configured for your port. You can see broadcast traffic such as ARP and DHCP, but you cannot see HTTP sessions between two other employee workstations on the same VLAN. To observe those conversations for the assessment, which technique would be most effective?
- A
Enable promiscuous mode in Wireshark so the NIC captures all frames traversing the switch
- B
Perform ARP spoofing/poisoning to place your system in the path of the victims' traffic
- C
Send repeated ICMP echo requests to force the switch to flood unicast traffic out all ports
- D
Use DNS cache poisoning so the victims' web sessions become visible to your sniffer
Show answer and explanation
Correct answer: B
Explanation
On switched Ethernet networks, passive sniffing is limited because the switch forwards unicast frames only to the relevant destination port. As a result, a host connected to a normal access port typically sees broadcast traffic, some multicast, and traffic addressed to itself. Promiscuous mode changes how the local NIC handles received frames, but it does not alter switch behavior. To capture traffic between other hosts without a SPAN/mirror port, an attacker or tester commonly uses an active interception technique such as ARP spoofing/poisoning to become a man-in-the-middle. This aligns with standard CEH sniffing concepts: hubs allow broad passive sniffing, while switched environments usually require traffic redirection or mirrored ports. For best-practice reference, vendor documentation from Cisco and other switch manufacturers explains SPAN/port mirroring for legitimate monitoring, while ARP behavior is defined in RFC 826, which underlies why ARP spoofing works on IPv4 LANs lacking protections such as Dynamic ARP Inspection.
- A. Incorrect.
Incorrect. Promiscuous mode allows a NIC and packet capture software to accept frames delivered to that interface even if they are not addressed to the local MAC address. However, on a switched Ethernet network, the switch still forwards unicast frames only to the port where the destination MAC is learned. Promiscuous mode does not make the switch send unrelated unicast traffic to your port, so it is not sufficient by itself.
- B. Correct.
Correct. ARP spoofing/poisoning is a practical man-in-the-middle technique on IPv4 LANs that exploits trust in ARP replies. By convincing each victim that your MAC address is associated with the other host's IP, you can cause traffic between them to traverse your system, where it can be captured and optionally forwarded. In a switched environment without port mirroring, this is one of the standard ways to observe other hosts' traffic during an authorized test.
- C. Incorrect.
Incorrect. ICMP echo requests do not cause a switch to flood learned unicast traffic to every port. Switches forward unicast based on their MAC address table and flood only unknown unicast, broadcast, and certain multicast traffic depending on configuration. This option reflects a common misconception that generating more traffic will somehow bypass normal switch forwarding behavior.
- D. Incorrect.
Incorrect. DNS cache poisoning can redirect victims to malicious systems or incorrect destinations, but it does not inherently make arbitrary Layer 2 traffic between two existing hosts visible to a passive sniffer on a switched network. It targets name resolution, not switch forwarding. A candidate might choose this because it is also a redirection attack, but it does not solve the specific packet visibility problem described.