312-50 Question 200
Single answer▪ Sniffing ToolsDuring an internal authorized assessment, you are connected to a standard access port on a modern switched Ethernet network. The client wants you to determine whether any legacy cleartext protocols are still being used by administrators. You start Wireshark and notice that, in normal mode, you only capture your own traffic plus broadcasts and multicasts. Which action would most effectively allow you to observe other hosts' unicast traffic on the same switch segment without changing the switch configuration?
- A
Enable promiscuous mode in Wireshark on your NIC
- B
Perform ARP spoofing/poisoning to place your system in the traffic path
- C
Run a SYN flood against the switch so it broadcasts all traffic to every port
- D
Switch the NIC from full-duplex to half-duplex mode
Show answer and explanation
Correct answer: B
Explanation
On switched Ethernet, passive sniffing is limited because unicast traffic is forwarded only to the appropriate switch port. Promiscuous mode is necessary for packet capture tools such as Wireshark to process all frames that arrive at the NIC, but it does not bypass switch forwarding behavior. To capture traffic between other hosts without switch reconfiguration, an attacker or tester typically needs to become part of the path, for example through ARP spoofing/poisoning on IPv4 LANs. This is why ARP-based man-in-the-middle techniques are commonly paired with sniffing tools such as Wireshark, tcpdump, Ettercap, or Cain & Abel in training and lab environments. Best practice defenses include static ARP entries where appropriate, DHCP snooping plus Dynamic ARP Inspection on managed switches, use of encrypted management protocols such as SSH instead of Telnet, and network segmentation. Wireshark documentation and standard Ethernet switching behavior both support the distinction between promiscuous mode and actual visibility into switched unicast traffic.
- A. Incorrect.
This is incorrect. Promiscuous mode allows the NIC and packet capture software to accept and process all frames that reach the interface, but on a switched network the switch still forwards most unicast frames only to the destination port. As a result, promiscuous mode alone does not let you see other hosts' unicast traffic unless that traffic is already being sent to your port, mirrored to your port, or converted into traffic that traverses your system.
- B. Correct.
This is correct. ARP spoofing/poisoning can be used on IPv4 local networks to convince hosts that the attacker's MAC address corresponds to another host, commonly the default gateway. This can place the attacker's machine in a man-in-the-middle position so tools such as Wireshark can capture transit traffic. In a switched environment, this is a practical way to observe other hosts' traffic without requiring SPAN/port mirroring or other switch changes, assuming the network is vulnerable and the assessment scope permits it.
- C. Incorrect.
This is incorrect. The idea behind this distractor comes from MAC flooding, not SYN flooding. A SYN flood targets TCP connection state on hosts or services, not the switch CAM table behavior relevant to sniffing. While MAC flooding has historically been discussed in security training, it is not described by this option, and many modern switches include protections that limit its effectiveness.
- D. Incorrect.
This is incorrect. Duplex settings affect how the NIC handles transmission and reception on the link, not whether a switch forwards other hosts' unicast traffic to your port. Changing to half-duplex would not make the switch send you traffic destined for other endpoints and would more likely just degrade performance or create link issues.