Which of the following attacks allows an attacker to sniff data frames on a local area network (LAN) or stop the traffic altogether?

Man-in-the-middle is a broad attack category describing an attacker's position between two parties; ARP spoofing is the specific LAN-level technique used to achieve that position.

ARP spoofing sends forged ARP reply packets that map the attacker's MAC address to a victim's IP address, causing other hosts on the LAN to forward frames to the attacker instead of the legitimate destination. This gives the attacker the ability to passively sniff data frames or actively drop them, halting communication between the targeted hosts on the local network.

Port scanning is a reconnaissance technique used to enumerate open services on a host and does not involve intercepting or blocking LAN data frames.

Session hijacking targets an already-established application or transport-layer session and does not operate at the data-link layer to sniff or halt raw LAN frames.