312-50 Question 195
Single answer▪ Sniffing Technique: Spoofing AttacksDuring an internal security assessment, you connect a test laptop to the same switched VLAN as several employee workstations and the default gateway. Your goal is to capture unencrypted HTTP credentials from one target workstation without physically reconfiguring the switch. You first poison the target's ARP cache so it maps the gateway IP address to your laptop's MAC address, and you simultaneously poison the gateway so it maps the target's IP address to your MAC address. However, after a few seconds, the target loses connectivity and users notice the issue. Which action should you take next to maintain the man-in-the-middle position while minimizing disruption?
- A
Enable IP forwarding on the attacking laptop so traffic received from the victim is routed to the real gateway and vice versa
- B
Send gratuitous ARP replies only to the switch so the CAM table redirects all VLAN traffic through the attacking laptop
- C
Disable the victim's NIC checksum offload so captured packets can be reassembled correctly by the attacker
- D
Launch a DHCP starvation attack so the victim renews its lease and uses the attacker's system as the default gateway
Show answer and explanation
Correct answer: A
Explanation
This scenario describes classic ARP cache poisoning used to perform a sniffing-based spoofing attack on a switched network. Because switches normally prevent passive sniffing of unicast traffic not destined for the attacker's port, the attacker poisons both endpoints so they send frames to the attacker's MAC address. To remain transparent, the attacker must then forward traffic between the victim and the gateway; otherwise, the attack degrades into a denial-of-service condition. On Linux, this is commonly done by enabling kernel IP forwarding (for example, via /proc/sys/net/ipv4/ip_forward), while other tools may implement packet relaying internally. This aligns with common penetration-testing practice and network behavior documented in ARP and IPv4 forwarding guidance. The key CEH concept is that successful spoofing for sniffing requires both redirection and relaying, not just cache poisoning.
- A. Correct.
Correct. In an ARP spoofing man-in-the-middle attack, the attacker must not only poison ARP caches but also forward packets between the victim and the legitimate gateway. Without IP forwarding (or an equivalent bridging/proxy mechanism), the attacker becomes a traffic sink, causing a denial of service rather than a transparent interception. Enabling IP forwarding allows the attacker to relay traffic in both directions, preserving connectivity while capturing packets.
- B. Incorrect.
Incorrect. Gratuitous ARP updates affect host ARP cache entries, not the switch's CAM table in the way described here. A switch learns MAC-to-port mappings from observed source MAC addresses in Ethernet frames, not from ARP replies alone as a method to redirect all VLAN traffic. This option confuses ARP spoofing with switch forwarding behavior and CAM table concepts.
- C. Incorrect.
Incorrect. NIC checksum offload can affect how packets appear in packet captures on the local host, but it does not solve the connectivity problem caused by failing to relay traffic. The issue in the scenario is interrupted forwarding after successful ARP poisoning, not packet reassembly or checksum interpretation.
- D. Incorrect.
Incorrect. DHCP starvation is a different attack technique used to exhaust a DHCP scope, often as a precursor to deploying a rogue DHCP server. It is unnecessary for an ARP-based man-in-the-middle on a local subnet and would create broader, noisy disruption rather than maintaining a stealthy sniffing position.