You are using a public Wi-Fi network inside a coffee shop. Before surfing the web, you use your VPN to prevent intruders from sniffing your traffic. If you did not have a VPN, how would you identify whether someone is performing an ARP spoofing attack on your laptop?

Question

Accepted Answer

A. You should check your ARP table and see if there is one IP address with two different MAC In an ARP spoofing attack, the attacker sends gratuitous ARP replies that map their own MAC address to a legitimate IP (such as the default gateway). This causes the victim's ARP table to show a single IP address associated with two different MAC addresses - one legitimate and one belonging to the attacker. Checking the ARP table with 'arp -a' on Windows or 'arp -n' on Linux reveals this anomaly directly.

Answer

B. You should scan the network using Nmap to check the MAC addresses of all the hosts and look Nmap scans the network for external hosts but does not directly reveal ARP table poisoning on the local machine, and an attacker can spoof MAC addresses in scan responses.

Answer

C. You should use netstat to check for any suspicious connections with another IP address within Netstat shows active TCP/UDP connections and listening ports, but ARP spoofing operates at Layer 2 and does not create a new connection entry visible in netstat.

Answer

D. You cannot identify such an attack and must use a VPN to protect your traffic, r ARP spoofing is detectable without a VPN by inspecting the local ARP cache, so this choice is factually incorrect.

You are using a public Wi-Fi network inside a coffee shop. Before surfing the web, you use your VPN to prevent intruders from sniffing your traffic. If you did not have a VPN, how would you identify…

Question

Options

How the community answered

Why each option

Topics

Community Discussion