Which of the following attacks allows an attacker to sniff data frames on a local area network (LAN) or stop the traffic altogether?

Port scanning discovers open ports and services on a target host but does not intercept or disrupt LAN traffic at the data frame level.

ARP spoofing works by sending falsified ARP messages that associate the attacker's MAC address with a legitimate IP address on the LAN. Once the ARP cache of victim devices is poisoned, all traffic intended for that IP is sent to the attacker instead, enabling packet sniffing or traffic disruption. This attack is highly effective on switched networks where passive sniffing alone would not capture other hosts' traffic.

Man-in-the-middle describes a broader attack category where an adversary secretly relays communications; ARP spoofing is one technique used to achieve it, not the attack that itself defines frame sniffing on a LAN.

Session hijacking targets authenticated application sessions by stealing or forging session tokens, not raw data frames at the LAN or ARP layer.