nerdexam
GIAC

GCIH · Question #56

Adam, a malicious hacker is sniffing the network to inject ARP packets. He injects broadcast frames onto the wire to conduct Man-in-The-Middle attack. Which of the following is the destination MAC…

The correct answer is C. 0xFFFFFFFFFFFF. The Ethernet broadcast MAC address is FF:FF:FF:FF:FF:FF (0xFFFFFFFFFFFF), which causes every device on a network segment to receive and process the frame, as used in ARP broadcast requests exploited in ARP spoofing attacks.

Vulnerability Exploitation & Privilege Escalation

Question

Adam, a malicious hacker is sniffing the network to inject ARP packets. He injects broadcast frames onto the wire to conduct Man-in-The-Middle attack. Which of the following is the destination MAC address of a broadcast frame?

Options

  • A0xDDDDDDDDD
  • B0x00000000000
  • C0xFFFFFFFFFFFF
  • D0xAAAAAAAAAA

How the community answered

(37 responses)
  • A
    3% (1)
  • B
    3% (1)
  • C
    86% (32)
  • D
    8% (3)

Why each option

The Ethernet broadcast MAC address is FF:FF:FF:FF:FF:FF (0xFFFFFFFFFFFF), which causes every device on a network segment to receive and process the frame, as used in ARP broadcast requests exploited in ARP spoofing attacks.

A0xDDDDDDDDD

0xDDDDDDDDD is not a valid 48-bit MAC address - it has an incorrect length - and is not defined as any standard Ethernet broadcast or multicast address.

B0x00000000000

0x00000000000 (all zeros) represents an unspecified or invalid MAC address in some contexts, such as an unconfigured interface; the all-zeros address is never used as an Ethernet broadcast destination.

C0xFFFFFFFFFFFFCorrect

Per the IEEE 802.3 Ethernet standard, the broadcast MAC address is FF:FF:FF:FF:FF:FF - all 48 bits set to 1; ARP uses this destination address so every host on the local segment receives the request, and an attacker performing ARP poisoning sends spoofed frames to this broadcast address to intercept traffic and conduct a Man-in-the-Middle attack.

D0xAAAAAAAAAA

0xAAAAAAAAAA is not a valid 48-bit MAC address due to its length, and does not correspond to any standardized Ethernet broadcast or multicast destination address.

Concept tested: Ethernet broadcast MAC address in ARP spoofing attacks

Source: https://www.rfc-editor.org/rfc/rfc826

Topics

#ARP poisoning#MITM attack#broadcast MAC address#network spoofing

Community Discussion

No community discussion yet for this question.

Full GCIH Practice