312-50 Question 192
Single answer▪ Sniffing Technique: ARP PoisoningDuring an authorized internal assessment of a small office network, you need to capture unencrypted HTTP credentials exchanged between a victim workstation and the default gateway on the same VLAN. The network uses switched Ethernet, so passive sniffing from your laptop does not reveal the victim's traffic. You decide to use ARP poisoning to position your system as a man-in-the-middle without causing an obvious outage. Which action is the MOST appropriate to achieve this goal?
- A
Send forged ARP replies to the victim mapping the gateway IP to your MAC address, and forged ARP replies to the gateway mapping the victim IP to your MAC address; then enable packet forwarding on your system.
- B
Send ICMP redirect messages to all hosts on the subnet so they permanently update their ARP caches to your MAC address and route all traffic through your system.
- C
Broadcast gratuitous ARP requests claiming the victim's IP address is unused, then disable STP on the switch so mirrored traffic reaches your interface.
- D
Flood the switch CAM table until it fails open, then rely on passive sniffing instead of modifying ARP state on the victim and gateway.
Show answer and explanation
Correct answer: A
Explanation
On a switched Ethernet network, passive sniffing usually captures only broadcast traffic and frames destined for the attacker's interface. To observe a target host's unicast traffic, an attacker performing an authorized assessment can use ARP cache poisoning to convince both the victim and the default gateway that the attacker's MAC address corresponds to the other's IP address. Because ARP is a stateless protocol and many hosts accept unsolicited ARP replies, forged replies can overwrite ARP cache entries. However, if the assessor does not enable IP forwarding or otherwise relay packets, the victim may lose connectivity, making the attack obvious. The best-practice understanding tested here is that successful ARP-poisoning-based sniffing requires both cache manipulation and traffic forwarding to maintain a transparent MITM. This aligns with standard TCP/IP and ARP behavior documented in networking references and reflected in common defensive guidance, such as using Dynamic ARP Inspection, static ARP entries for critical systems where feasible, network segmentation, and encrypted protocols like HTTPS to reduce credential exposure even if interception occurs.
- A. Correct.
Correct. ARP poisoning on a switched LAN is typically performed by sending forged ARP replies to both endpoints so each associates the other party's IP address with the attacker's MAC address. To avoid disrupting connectivity and to continue observing traffic, the attacker's host must forward packets between the victim and the gateway. This creates a practical man-in-the-middle position suitable for sniffing cleartext protocols such as HTTP.
- B. Incorrect.
Incorrect. ICMP redirects can influence routing behavior under limited conditions, but they do not update ARP caches to the attacker's MAC address in the way described. They are not the standard or reliable mechanism for achieving ARP poisoning-based interception on a local switched network. A candidate might pick this because redirects relate to path changes, but the question specifically requires ARP-based MITM.
- C. Incorrect.
Incorrect. Gratuitous ARP is a real ARP behavior, but the description is technically wrong for this objective. Claiming an IP is unused does not place the attacker between the victim and gateway, and disabling STP is unrelated to ARP poisoning and would generally require switch administrative access. The mention of mirrored traffic confuses ARP spoofing with switch port mirroring.
- D. Incorrect.
Incorrect. CAM table flooding is a different attack technique, often associated with switch port flooding/MAC flooding, not ARP poisoning. It may generate noisy conditions and can be unreliable on modern switches with protections enabled. The scenario specifically asks for the most appropriate way to use ARP poisoning to intercept one host's traffic without an obvious outage.