312-50 Question 184
Single answer▪ Sniffing Technique: MAC AttacksDuring an internal security assessment, you connect a laptop running a packet sniffer to an access-layer switch in a corporate LAN. The switch is configured normally and the port is not mirrored. You notice that your sniffer only captures broadcasts and traffic to or from your own host. To observe traffic from other systems on the same VLAN without changing switch configuration, you decide to attempt a MAC-based sniffing attack. Which action is the most appropriate to make the switch begin forwarding additional frames out of your port?
- A
Launch a CAM table overflow by sending frames with many different spoofed source MAC addresses until the switch starts flooding unknown unicast traffic
- B
Send gratuitous ARP replies to convince hosts that your MAC address is the default gateway and then passively wait for the switch to mirror all VLAN traffic
- C
Transmit forged BPDU packets to force the switch into hub mode so all frames are repeated to every port
- D
Enable NIC promiscuous mode on your laptop so the switch forwards all same-VLAN frames to your interface
Show answer and explanation
Correct answer: A
Explanation
In a switched Ethernet environment, unicast traffic is normally forwarded only to the port associated with the destination MAC address in the switch's CAM/MAC address table. As a result, merely attaching a sniffer and enabling promiscuous mode is insufficient for capturing other hosts' traffic. A MAC flooding attack attempts to overwhelm the switch's CAM table with bogus source MAC entries. On vulnerable or poorly configured switches, this can cause unknown unicast flooding, which may expose additional traffic to the attacker's port. This is the core idea behind MAC attacks in sniffing scenarios covered in CEH. By contrast, ARP spoofing is a different attack family that poisons Layer 3-to-Layer 2 mappings to redirect traffic, while STP/BPDU manipulation targets topology control rather than directly enabling packet capture. As a defensive best practice, network administrators typically use features such as port security, limiting MAC addresses per port, 802.1X, DHCP snooping, Dynamic ARP Inspection, and switch hardening to reduce the risk of MAC flooding and related Layer 2 attacks. Vendor documentation from major switch manufacturers commonly recommends port security and control-plane protections specifically to mitigate CAM table overflow behavior.
- A. Correct.
Correct. A CAM table overflow, commonly called MAC flooding, attempts to exhaust the switch's Content Addressable Memory by injecting frames with numerous fake source MAC addresses. When the CAM table is full, some switches may fail open for unknown unicast traffic and flood frames out multiple ports, allowing a sniffer to capture traffic not originally destined for it. This is the classic MAC attack associated with switch-based sniffing in CEH contexts.
- B. Incorrect.
Incorrect. Gratuitous ARP replies are used in ARP spoofing/poisoning, not MAC flooding. They can redirect traffic through the attacker's system, but they do not cause the switch to mirror all VLAN traffic. Also, simply waiting passively after ARP spoofing is not accurate in many environments because successful interception usually requires positioning as a man-in-the-middle and often forwarding traffic to avoid disruption.
- C. Incorrect.
Incorrect. Forged BPDU traffic relates to Spanning Tree Protocol attacks, such as attempting to influence root bridge election or trigger topology changes. It does not place a switch into a generic 'hub mode' for sniffing. This distractor targets the common misconception that any Layer 2 control-plane manipulation will cause broad frame flooding.
- D. Incorrect.
Incorrect. Promiscuous mode only affects what the local NIC accepts from frames already delivered to the port. It does not change switch forwarding behavior. On a switched network, a NIC in promiscuous mode still cannot see arbitrary unicast traffic unless the switch sends those frames to that port due to mirroring, flooding, misconfiguration, or an attack such as MAC flooding.