312-50 Question 186
Single answer▪ Sniffing Technique: MAC AttacksDuring an authorized internal assessment, you connect a test laptop to an enterprise access switch in a user VLAN. The switch is configured with no port security, and the port is forwarding traffic normally. Your objective is to observe other hosts' traffic on the same switched segment without compromising the switch itself. Which technique would most effectively enable packet sniffing in this scenario?
- A
Launch a MAC flooding attack to overflow the switch CAM table so the switch begins forwarding frames out multiple ports like a hub
- B
Send forged ARP replies to poison the default gateway's ARP cache and force the switch to mirror all VLAN traffic to your port
- C
Transmit ICMP redirect messages so endpoints resend their packets directly to your NIC at Layer 2
- D
Abuse DHCP starvation so the switch fails open and broadcasts all unicast frames to every connected system
Show answer and explanation
Correct answer: A
Explanation
The best answer is MAC flooding. In switched Ethernet environments, normal unicast traffic is forwarded only to the port associated with the destination MAC address stored in the switch's CAM table. A MAC flooding attack attempts to fill that table with bogus entries so legitimate destination lookups may fail, causing unknown unicast flooding and making sniffing possible from another port. This is the CEH-relevant MAC attack associated with packet sniffing on switches. Defenses include port security, limiting MAC addresses per port, enabling 802.1X/NAC where appropriate, and monitoring for anomalous MAC learning behavior. Cisco documentation and common switch hardening guidance describe CAM table behavior, unknown unicast flooding, and port security as key mitigations.
- A. Correct.
Correct. A MAC flooding attack overwhelms the switch's CAM (Content Addressable Memory) table with many fake source MAC addresses. When the CAM table can no longer learn new mappings reliably, some switches may begin flooding unknown unicast traffic out multiple ports, allowing an attacker to sniff traffic not originally destined for their interface. This is a classic MAC attack relevant to sniffing on switched networks, especially when basic protections such as port security are absent.
- B. Incorrect.
Incorrect. ARP poisoning is a valid sniffing-related technique, but it is an ARP-based man-in-the-middle attack, not a MAC flooding attack. It manipulates Layer 3-to-Layer 2 address resolution between hosts and the gateway rather than overflowing the switch CAM table. Also, ARP poisoning does not cause the switch to mirror all VLAN traffic to the attacker's port.
- C. Incorrect.
Incorrect. ICMP redirects can influence routing behavior on hosts in some environments, but they do not cause a Layer 2 switch to forward other hosts' traffic to the attacker's port for general sniffing. This option confuses host routing manipulation with switched Ethernet forwarding behavior.
- D. Incorrect.
Incorrect. DHCP starvation targets DHCP address allocation by exhausting the available lease pool. It can enable follow-on attacks such as setting up a rogue DHCP server, but it does not make a switch 'fail open' and broadcast all unicast traffic. This distractor reflects a common misconception that exhausting one network service changes Layer 2 switching behavior.