nerdexam
EC-Council

312-50V10 · Question #337

A hacker, who posed as a heating and air conditioning specialist, was able to install a sniffer program in a switched environment network. Which attack could the hacker use to sniff all of the…

The correct answer is B. MAC Flood. A MAC Flood attack overwhelms a switch's CAM table, causing it to fail open and broadcast all traffic to every port, which allows a sniffer to capture packets in a switched environment.

Sniffing

Question

A hacker, who posed as a heating and air conditioning specialist, was able to install a sniffer program in a switched environment network. Which attack could the hacker use to sniff all of the packets in the network?

Options

  • AFraggle
  • BMAC Flood
  • CSmurf
  • DTear Drop

How the community answered

(27 responses)
  • A
    7% (2)
  • B
    89% (24)
  • D
    4% (1)

Why each option

A MAC Flood attack overwhelms a switch's CAM table, causing it to fail open and broadcast all traffic to every port, which allows a sniffer to capture packets in a switched environment.

AFraggle

Fraggle is a UDP-based amplification denial-of-service attack that floods a target with UDP echo replies; it does not enable packet sniffing on a switched network.

BMAC FloodCorrect

Switches normally forward traffic only to the port associated with the destination MAC address using their Content Addressable Memory (CAM) table. A MAC Flood attack sends thousands of frames with spoofed source MAC addresses, exhausting the CAM table. Once the table is full, the switch enters a fail-open state and broadcasts all incoming frames out every port, effectively behaving like a hub and exposing all network traffic to the attacker's sniffer.

CSmurf

Smurf is an ICMP-based amplification DDoS attack that floods a victim with ping replies; it is not a technique for capturing traffic in a switched environment.

DTear Drop

Tear Drop is an IP fragmentation attack that sends malformed overlapping packet fragments to crash vulnerable operating systems; it does not enable traffic sniffing.

Concept tested: MAC flood attack to bypass switch traffic isolation

Source: https://www.cisco.com/c/en/us/support/docs/lan-switching/spanning-tree-protocol/10556-56.html

Topics

#MAC flooding#switched network#sniffing#ARP attack

Community Discussion

No community discussion yet for this question.

Full 312-50V10 Practice