312-50V9 · Question #111
A hacker, who posed as a heating and air conditioning specialist, was able to install a sniffer program in a switched environment network. Which attack could the hacker use to sniff all of the…
The correct answer is B. MAC Flood. In a switched network, a MAC Flood attack overwhelms the switch's CAM table, causing it to broadcast all frames to every port and allowing an attacker to sniff all traffic.
Question
A hacker, who posed as a heating and air conditioning specialist, was able to install a sniffer program in a switched environment network. Which attack could the hacker use to sniff all of the packets in the network?
Options
- AFraggle
- BMAC Flood
- CSmurf
- DTear Drop
How the community answered
(46 responses)- A2% (1)
- B89% (41)
- C2% (1)
- D7% (3)
Why each option
In a switched network, a MAC Flood attack overwhelms the switch's CAM table, causing it to broadcast all frames to every port and allowing an attacker to sniff all traffic.
A Fraggle attack is a DDoS amplification attack that sends UDP packets to broadcast addresses to flood a target with reflected traffic, not a technique for passively capturing network packets.
A MAC Flood attack sends thousands of spoofed MAC addresses to the switch's Content Addressable Memory (CAM) table, exhausting its capacity. When the table is full, the switch enters fail-open mode and broadcasts all frames to every port, effectively converting it to a hub. This allows the attacker's sniffer to capture all traffic on the network segment.
A Smurf attack is a DDoS amplification attack that floods a target with ICMP echo replies by spoofing the victim's IP to a broadcast address, not a method for sniffing network traffic.
A Tear Drop attack exploits IP fragmentation by sending malformed overlapping packet fragments to crash a target host, and has no capability for capturing or sniffing network traffic.
Concept tested: MAC flooding to enable sniffing on switched networks
Source: https://attack.mitre.org/techniques/T1040/
Topics
Community Discussion
No community discussion yet for this question.