312-50V10 · Question #337
A hacker, who posed as a heating and air conditioning specialist, was able to install a sniffer program in a switched environment network. Which attack could the hacker use to sniff all of the…
The correct answer is B. MAC Flood. A MAC Flood attack overwhelms a switch's CAM table, causing it to fail open and broadcast all traffic to every port, which allows a sniffer to capture packets in a switched environment.
Question
A hacker, who posed as a heating and air conditioning specialist, was able to install a sniffer program in a switched environment network. Which attack could the hacker use to sniff all of the packets in the network?
Options
- AFraggle
- BMAC Flood
- CSmurf
- DTear Drop
How the community answered
(27 responses)- A7% (2)
- B89% (24)
- D4% (1)
Why each option
A MAC Flood attack overwhelms a switch's CAM table, causing it to fail open and broadcast all traffic to every port, which allows a sniffer to capture packets in a switched environment.
Fraggle is a UDP-based amplification denial-of-service attack that floods a target with UDP echo replies; it does not enable packet sniffing on a switched network.
Switches normally forward traffic only to the port associated with the destination MAC address using their Content Addressable Memory (CAM) table. A MAC Flood attack sends thousands of frames with spoofed source MAC addresses, exhausting the CAM table. Once the table is full, the switch enters a fail-open state and broadcasts all incoming frames out every port, effectively behaving like a hub and exposing all network traffic to the attacker's sniffer.
Smurf is an ICMP-based amplification DDoS attack that floods a victim with ping replies; it is not a technique for capturing traffic in a switched environment.
Tear Drop is an IP fragmentation attack that sends malformed overlapping packet fragments to crash vulnerable operating systems; it does not enable traffic sniffing.
Concept tested: MAC flood attack to bypass switch traffic isolation
Source: https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10556-56.html
Topics
Community Discussion
No community discussion yet for this question.