nerdexam
EC-Council

312-50V9 · Question #111

A hacker, who posed as a heating and air conditioning specialist, was able to install a sniffer program in a switched environment network. Which attack could the hacker use to sniff all of the…

The correct answer is B. MAC Flood. In a switched network, a MAC Flood attack overwhelms the switch's CAM table, causing it to broadcast all frames to every port and allowing an attacker to sniff all traffic.

Sniffing

Question

A hacker, who posed as a heating and air conditioning specialist, was able to install a sniffer program in a switched environment network. Which attack could the hacker use to sniff all of the packets in the network?

Options

  • AFraggle
  • BMAC Flood
  • CSmurf
  • DTear Drop

How the community answered

(46 responses)
  • A
    2% (1)
  • B
    89% (41)
  • C
    2% (1)
  • D
    7% (3)

Why each option

In a switched network, a MAC Flood attack overwhelms the switch's CAM table, causing it to broadcast all frames to every port and allowing an attacker to sniff all traffic.

AFraggle

A Fraggle attack is a DDoS amplification attack that sends UDP packets to broadcast addresses to flood a target with reflected traffic, not a technique for passively capturing network packets.

BMAC FloodCorrect

A MAC Flood attack sends thousands of spoofed MAC addresses to the switch's Content Addressable Memory (CAM) table, exhausting its capacity. When the table is full, the switch enters fail-open mode and broadcasts all frames to every port, effectively converting it to a hub. This allows the attacker's sniffer to capture all traffic on the network segment.

CSmurf

A Smurf attack is a DDoS amplification attack that floods a target with ICMP echo replies by spoofing the victim's IP to a broadcast address, not a method for sniffing network traffic.

DTear Drop

A Tear Drop attack exploits IP fragmentation by sending malformed overlapping packet fragments to crash a target host, and has no capability for capturing or sniffing network traffic.

Concept tested: MAC flooding to enable sniffing on switched networks

Source: https://attack.mitre.org/techniques/T1040/

Topics

#MAC flooding#switched network#sniffing#ARP

Community Discussion

No community discussion yet for this question.

Full 312-50V9 Practice