Examkin

Question

Difficulty: EasyCommon Network Attack Types and Vectors

A network administrator notices that local endpoint traffic intended for the default gateway is being redirected to an unauthorized workstation. Packet captures reveal that the unauthorized workstation is repeatedly sending unsolicited gratuitous ARP replies associating the default gateway's IP address with its own MAC address. Which of the following attack types is occurring?

  1. ARP poisoningAnswer
  2. B
    DNS cache poisoning
  3. C
    DNS AAAA record spoofing
  4. D
    Port 22 SSH relay attack

Answer

ARP poisoning
ARP poisoning involves broadcasting forged ARP response messages on a local network to link an attacker's MAC address with a legitimate IP address (such as the default gateway). This redirects local subnet traffic through the attacker's computer.

Step-by-Step Solution

1
Analyze the reported network anomaly and protocol traffic
The packet capture identifies unsolicited gratuitous ARP replies mapping a gateway IP to an unauthorized MAC address.
Address Resolution Protocol (ARP) maps Layer 3 IPv4 addresses to Layer 2 MAC hardware addresses on local Ethernet subnets.
2
Determine the attack vector based on the protocol behavior
Spoofing ARP replies to intercept local traffic is known as ARP poisoning (or ARP spoofing).
By corrupting the ARP tables of neighboring hosts, the attacker positions themselves on-path for intercepted network traffic.

Key Concept

Address Resolution Protocol (ARP) Poisoning
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic