nerdexam
GIAC

GCIA · Question #55

An attacker wants to launch an attack on a wired Ethernet. He wants to accomplish the following tasks:  Sniff data frames on a local area network.  Modify the network traffic.  Stop the network…

The correct answer is C. ARP spoofing. ARP spoofing allows an attacker to position themselves between network hosts on a LAN, enabling sniffing, modification, and disruption of Ethernet traffic through a man-in-the-middle attack.

Network Forensics, Protocol Insecurity & Evasion Techniques

Question

An attacker wants to launch an attack on a wired Ethernet. He wants to accomplish the following tasks:

 Sniff data frames on a local area network.  Modify the network traffic.  Stop the network traffic frequently. Which of the following techniques will the attacker use to accomplish the task?

Options

  • AIP spoofing
  • BEavesdropping
  • CARP spoofing
  • DSession hijacking

How the community answered

(13 responses)
  • B
    8% (1)
  • C
    77% (10)
  • D
    15% (2)

Why each option

ARP spoofing allows an attacker to position themselves between network hosts on a LAN, enabling sniffing, modification, and disruption of Ethernet traffic through a man-in-the-middle attack.

AIP spoofing

IP spoofing involves forging the source IP address in packets to impersonate another host, but it does not position the attacker inline to sniff or modify LAN Ethernet frames.

BEavesdropping

Eavesdropping is passive listening and allows sniffing data but does not enable traffic modification or selective stopping of network traffic.

CARP spoofingCorrect

ARP spoofing works by sending forged ARP (Address Resolution Protocol) replies to associate the attacker's MAC address with a legitimate IP address on the local network. This redirects traffic through the attacker's machine, enabling passive sniffing of data frames, active modification of traffic in transit, and selective dropping of packets to stop network communication. All three objectives listed in the question are achievable through this single technique.

DSession hijacking

Session hijacking takes over an established TCP session after authentication, but does not inherently provide the ability to sniff all LAN frames or stop network traffic at the Ethernet level.

Concept tested: ARP spoofing man-in-the-middle attack on LAN

Source: https://learn.microsoft.com/en-us/windows-server/networking/technologies/arp-poisoning

Topics

#ARP spoofing#man-in-the-middle#LAN attacks#traffic manipulation

Community Discussion

No community discussion yet for this question.

Sign up to join the discussion
Full GCIA Practice