312-50 Question 206
Single answer▪ Sniffing Detection TechniquesDuring an internal security assessment, you suspect that a workstation on the same VLAN as several finance servers has been placed into promiscuous mode to capture unicast traffic. You want a quick host-discovery technique that can help identify a NIC listening to all frames, without requiring credentials on the target system. Which approach is MOST appropriate for detecting a potential sniffer in this scenario?
- A
Send a crafted non-broadcast ARP request with an incorrect destination MAC address and watch for a response from the suspected host
- B
Run a standard ICMP echo sweep across the subnet and identify hosts with the lowest latency
- C
Query the switch CAM table and look for the port with the highest number of learned MAC addresses
- D
Perform a TCP SYN scan of common ports on the suspected host and check whether port 80 is open
Show answer and explanation
Correct answer: A
Explanation
The best answer is the crafted ARP-based probe using an incorrect Layer 2 destination MAC. Promiscuous mode detection on a local network segment often relies on sending malformed or specially addressed frames that a normal host should ignore at Layer 2. If the target still processes and responds, that suggests the NIC or packet capture stack is accepting all frames. This technique is commonly referenced in ethical hacking and network security training as a practical way to detect sniffers without host access. By contrast, ping sweeps and port scans are standard discovery and enumeration methods, not sniffing detection methods. Checking switch CAM tables may be useful for investigating switching anomalies such as MAC flooding or CAM table overflow, but it is not a reliable indicator that a host is sniffing in promiscuous mode. From a defensive best-practice perspective, administrators should combine such active tests with switch port security, monitoring for unauthorized span/mirror ports, endpoint detection, and use of encryption protocols such as SSH, TLS, and IPsec to reduce the impact of sniffing. These principles align with common guidance from network security best practices and vendor documentation on switched network monitoring and packet capture risks.
- A. Correct.
Correct. A classic sniffing detection technique is to send a frame addressed to a bogus or incorrect destination MAC but containing the suspected host's IP information in a higher-layer payload such as ARP. A normal NIC should discard the frame because the Layer 2 destination does not match. A host in promiscuous mode may still pass the frame up the stack and respond, revealing that it is processing traffic not actually addressed to its MAC. This is one of the practical local-segment techniques discussed in sniffing detection methodologies.
- B. Incorrect.
Incorrect. An ICMP echo sweep is useful for host discovery, not for identifying whether a NIC is operating in promiscuous mode. Low latency might reflect proximity, device type, or network conditions, but it does not indicate packet-sniffing behavior.
- C. Incorrect.
Incorrect. Reviewing the switch CAM table can help identify unusual switching behavior such as MAC flooding effects, but it does not directly detect a host NIC in promiscuous mode. A single workstation sniffing traffic typically still appears as one MAC on one switch port, so this method would not reliably identify a sniffer.
- D. Incorrect.
Incorrect. A TCP SYN scan identifies listening services and exposed ports. Whether port 80 or any other port is open has no meaningful connection to whether the network adapter is accepting frames not addressed to it. This distractor reflects confusion between service enumeration and sniffing detection.