312-50 Question 190
Single answer▪ Sniffing Technique: ARP PoisoningDuring an internal security assessment, you are connected to the same switched IPv4 subnet as several employee workstations and the default gateway. Your goal is to capture a user's unencrypted web session without disrupting connectivity long enough to alert the user. Which action is the most effective way to position your system as a man-in-the-middle using ARP poisoning?
- A
Send forged gratuitous ARP replies to the victim mapping the gateway IP to your MAC address, and simultaneously send forged ARP replies to the gateway mapping the victim IP to your MAC address, while enabling packet forwarding on your host
- B
Flood the switch with TCP SYN packets until it mirrors all traffic to your port, then capture the victim's packets with a sniffer
- C
Send ICMP redirect messages to the victim so it updates its ARP cache to point the gateway IP at your MAC address
- D
Transmit DNS spoofed responses to the victim so all of its traffic is redirected through your interface without changing ARP entries
Show answer and explanation
Correct answer: A
Explanation
The best answer is the bidirectional ARP poisoning approach combined with packet forwarding. On a switched IPv4 LAN, ARP is used to resolve IP addresses to MAC addresses and is inherently unauthenticated. An attacker on the same broadcast domain can send unsolicited or forged ARP replies to poison ARP caches on both the victim and the gateway. To remain stealthy enough for session capture, the attacker must continue forwarding packets between both endpoints; otherwise, connectivity breaks and the user notices immediately. This is a classic man-in-the-middle setup frequently demonstrated with tools such as Ettercap, Bettercap, and arpspoof. Defensive guidance commonly includes Dynamic ARP Inspection, static ARP entries for critical systems where practical, port security, VLAN segmentation, and the use of encrypted protocols such as HTTPS so captured traffic is less useful. These practices are consistent with standard network security guidance and vendor documentation on ARP spoofing mitigation.
- A. Correct.
Correct. ARP poisoning on a local IPv4 LAN works by sending forged ARP replies so the victim associates the gateway's IP address with the attacker's MAC address, and the gateway associates the victim's IP address with the attacker's MAC address. This creates a bidirectional man-in-the-middle position. Enabling IP forwarding or otherwise relaying traffic is essential to keep the connection working and avoid obvious disruption that would alert the user.
- B. Incorrect.
Incorrect. SYN flooding is a denial-of-service technique against TCP services, not a method for gaining visibility into switched Layer 2 traffic. Switches do not mirror traffic to an attacker's port because of TCP SYN floods. Some candidates confuse this with MAC flooding against CAM tables, but that is a different concept and still not the best answer for targeted ARP poisoning.
- C. Incorrect.
Incorrect. ICMP redirects can influence routing behavior under limited conditions, but they do not directly rewrite ARP cache entries to map an IP to an attacker's MAC address. ARP poisoning specifically abuses ARP's trust model with forged ARP replies. Choosing this option reflects confusion between Layer 3 route manipulation and Layer 2 address resolution poisoning.
- D. Incorrect.
Incorrect. DNS spoofing can alter name resolution results, but it does not transparently place the attacker inline for arbitrary victim-to-gateway traffic on the local subnet. A victim may still send packets directly to the gateway at Layer 2. This option mixes application-layer redirection with ARP-based man-in-the-middle positioning and is not the most effective technique for the stated objective.