312-50 Question 199
Single answer▪ Sniffing ToolsDuring an authorized internal security assessment, you are connected to a standard switched Ethernet network and need to verify whether legacy protocols are exposing credentials in cleartext. You start Wireshark on your laptop and see only broadcast traffic and your own unicast packets. To observe a target workstation's Telnet and FTP authentication traffic between that host and the default gateway without reconfiguring the switch, which approach is the most appropriate?
- A
Use ARP spoofing/poisoning to position your host as a man-in-the-middle, then capture the relayed traffic with Wireshark
- B
Enable monitor mode on the Ethernet interface so Wireshark can capture all switched unicast traffic on the VLAN
- C
Send ICMP echo requests to the target continuously so the switch mirrors the target's traffic to your port
- D
Use DNS cache poisoning so the target sends Telnet and FTP credentials directly to your laptop for capture
Show answer and explanation
Correct answer: A
Explanation
The key issue is the difference between shared-media and switched environments. On a switched Ethernet network, unicast traffic is normally delivered only to the destination port, so simply running a sniffer like Wireshark in promiscuous mode is insufficient to observe another host's sessions. To capture that traffic without switch reconfiguration such as SPAN/port mirroring, the assessor must get into the traffic path. ARP spoofing/poisoning is a well-known method for IPv4 local networks because it abuses the trust-based nature of ARP to redirect frames through the attacker's host. Once inline, a sniffer can capture cleartext protocols such as Telnet and FTP, which is why these protocols are considered insecure and deprecated in favor of SSH and SFTP/FTPS. This aligns with common network security guidance and vendor documentation on ARP behavior, switched Ethernet visibility, and the risks of legacy plaintext protocols.
- A. Correct.
Correct. On a switched Ethernet network, a normal host typically cannot see other hosts' unicast traffic unless it is on the path. ARP spoofing/poisoning can trick the target and gateway into associating the attacker's MAC address with each other's IP addresses, placing the assessor in a man-in-the-middle position. Once traffic is relayed through the assessor's system, Wireshark can capture cleartext Telnet and FTP credentials. This is a classic sniffing technique in lab and authorized assessment scenarios.
- B. Incorrect.
Incorrect. Monitor mode is associated with wireless interfaces, not standard Ethernet NICs on switched networks. Even with promiscuous mode enabled, a wired interface connected to a switch port does not automatically receive all unicast traffic for the VLAN. This option reflects a common confusion between promiscuous mode, monitor mode, and switched-network behavior.
- C. Incorrect.
Incorrect. ICMP echo requests do not cause a switch to mirror another host's traffic to your port. Switches forward frames based on MAC address tables, and simply generating pings does not alter forwarding behavior in a way that enables passive sniffing of unrelated unicast sessions. This distractor targets the misconception that extra traffic generation can somehow reveal switched traffic.
- D. Incorrect.
Incorrect. DNS cache poisoning manipulates name resolution, but it does not by itself place you inline for arbitrary existing Telnet and FTP sessions between a target and its default gateway. It may redirect users to rogue services in some attack scenarios, but it is not the appropriate method for directly sniffing another host's switched unicast traffic already destined elsewhere.