Which of the following techniques does an attacker use to sniff data frames on a local area network and modify the traffic?

MAC spoofing changes the attacker's own MAC address to impersonate another device but does not inherently allow sniffing or modification of other devices' traffic in transit.

IP address spoofing forges the source IP in packets for anonymity or session hijacking but does not enable passive sniffing or modification of LAN data frames.

Email spoofing forges the sender address in email headers and operates at the application layer, having no mechanism to sniff or alter LAN-level data frames.

ARP spoofing works by sending gratuitous or forged ARP replies that poison the ARP cache of devices on the local network, redirecting traffic through the attacker's machine. This enables both sniffing of data frames and active modification of traffic before forwarding it, making it a man-in-the-middle technique at Layer 2. It operates locally on the LAN segment, which is why it is effective against local network traffic specifically.