312-50 Question 207
Single answer▪ Sniffing Detection TechniquesDuring an internal security assessment, you suspect that a Linux workstation on the same VLAN as several finance systems has been placed into promiscuous mode to capture unicast traffic not addressed to it. You have permission to perform active verification, but you want a technique that specifically helps detect a host behaving like a packet sniffer on a switched network rather than simply identifying open ports or running services. Which action is the BEST choice?
- A
Send crafted ARP requests with a non-broadcast destination MAC address to the suspected host and monitor whether it replies
- B
Run a standard TCP SYN scan against the suspected host and look for open administrative ports
- C
Query the switch CAM table and compare it to the host ARP cache entries
- D
Perform a DNS zone transfer request against the internal DNS server used by the suspected host
Show answer and explanation
Correct answer: A
Explanation
On switched networks, passive sniffing is limited because switches normally forward unicast traffic only to the intended port. However, if an assessor suspects a host is configured to capture traffic opportunistically, active detection can help identify interfaces in promiscuous mode. A well-known CEH-relevant method is to send ARP frames crafted so that a normal host should ignore them; if the target responds, that suggests the interface or sniffing software is processing traffic beyond frames addressed to its MAC. In contrast, port scanning, DNS testing, and table comparison are useful for other assessment objectives but do not directly validate promiscuous-mode sniffing behavior. Best practice is to use such active detection only with authorization and to correlate findings with endpoint inspection, switch telemetry, and host-based controls.
- A. Correct.
Correct. One classic active sniffing detection approach is to send deliberately crafted ARP traffic that a normal NIC should ignore unless it is operating in promiscuous mode or a capture driver is processing all frames. If the host responds to an ARP request encapsulated in a frame not normally intended for it, that behavior can indicate promiscuous mode sniffing. This aligns with CEH coverage of active sniffing detection methods such as ARP-based tests for promiscuous interfaces.
- B. Incorrect.
Incorrect. A SYN scan can reveal reachable services, but it does not specifically indicate whether the network interface is in promiscuous mode or whether the system is sniffing traffic. A host can be running a sniffer without exposing unusual ports, so this method tests a different problem.
- C. Incorrect.
Incorrect. Checking CAM and ARP information may help with troubleshooting layer 2 or layer 3 mappings, but it does not directly detect whether an endpoint NIC is accepting and processing frames not addressed to it. It is useful context for network analysis, but not a targeted sniffing detection technique.
- D. Incorrect.
Incorrect. A DNS zone transfer test is relevant to DNS misconfiguration and information disclosure, not to detection of packet sniffers. Someone might choose it because it is an active reconnaissance technique, but it has no meaningful relationship to identifying promiscuous mode on a workstation.