312-50 Question 193
Select 2▪ Sniffing Technique: Spoofing AttacksDuring an internal security assessment, you connect to a user VLAN and observe that several Windows workstations suddenly begin sending traffic through your test laptop instead of the default gateway. You want to confirm whether a successful spoofing-based sniffing attack is occurring that could enable credential interception or session hijacking on the local subnet. Which two actions would most directly validate that an ARP spoofing man-in-the-middle attack is in progress?
- A
Capture ARP traffic and verify that the attacker's MAC address is being advertised as the MAC for the default gateway IP and/or victim IP
- B
Review the victim hosts' ARP cache entries and confirm that the gateway IP resolves to the attacker's MAC address instead of the legitimate router MAC
- C
Check whether the DNS server returned multiple A records for the gateway hostname during the assessment window
- D
Confirm that the switch port connected to the attacker is operating in promiscuous mode
- E
Verify that the victim and attacker are using the same TCP initial sequence number values for active sessions
Show answer and explanation
Correct answers: A, B
Explanation
This scenario describes a classic ARP spoofing (ARP poisoning) attack used for sniffing on a switched LAN. Because switches normally forward unicast traffic only to the correct port, an attacker often uses spoofing to insert themselves into the path between a victim and the default gateway. The most reliable validation steps are to inspect ARP traffic for forged replies and to examine ARP cache entries on impacted systems. If the victim associates the gateway IP with the attacker's MAC address, traffic can be redirected through the attacker for man-in-the-middle monitoring, credential capture, or session hijacking. This aligns with standard networking behavior defined in ARP-related RFCs such as RFC 826 and with common defensive guidance from network security vendors: monitor for gratuitous or inconsistent ARP replies, use Dynamic ARP Inspection where supported, and validate MAC/IP bindings when investigating suspected Layer 2 spoofing.
- A. Correct.
Correct. ARP spoofing/ARP poisoning works by sending forged ARP replies that map the attacker's MAC address to another host's IP address, commonly the default gateway and/or a victim system. Capturing ARP frames and seeing unsolicited or repeated ARP replies claiming the gateway IP belongs to the attacker's MAC is one of the clearest indicators of an ARP-based man-in-the-middle sniffing attack.
- B. Correct.
Correct. On affected hosts, the ARP cache should normally contain the legitimate MAC address of the default gateway. If the gateway IP now maps to the attacker's MAC address, that directly shows ARP cache poisoning has occurred. This is a standard validation step during incident response and penetration testing when investigating Layer 2 spoofing attacks.
- C. Incorrect.
Incorrect. Multiple DNS A records relate to name resolution behavior such as round-robin DNS or load balancing, not ARP poisoning. ARP spoofing occurs at Layer 2 and targets IP-to-MAC mappings on the local network segment; DNS responses do not directly validate that a spoofing-based sniffing attack is happening.
- D. Incorrect.
Incorrect. Promiscuous mode is a NIC setting that allows a host to capture traffic it receives, but switch ports themselves are not said to operate in promiscuous mode in this sense. More importantly, ARP poisoning does not require proving a switch port is in promiscuous mode; the direct evidence is forged ARP mappings and poisoned ARP caches.
- E. Incorrect.
Incorrect. TCP initial sequence numbers are unrelated to validating ARP spoofing. While sequence number prediction is a different attack topic, matching or differing ISNs does not indicate whether a host has poisoned ARP tables and placed itself in the traffic path.