Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A network administrator receives an alert from an Intrusion Detection System (IDS) displaying the following log entries captured from a local subnet:

[WARN] Unsolicited ARP Reply detected: 192.168.1.1 is at 00:11:22:AA:BB:CC (Previous MAC: 00:00:0C:07:AC:01)
[WARN] Unsolicited ARP Reply detected: 192.168.1.1 is at 00:11:22:AA:BB:CC (Host 192.168.1.45 ARP cache updated)
[INFO] Traffic for default gateway 192.168.1.1 rerouted through 00:11:22:AA:BB:CC

Based on these technical indicators, which of the following network attacks is actively occurring?

  1. ARP poisoningAnswer
  2. B
    MAC flooding
  3. C
    DNS spoofing
  4. D
    Rogue DHCP server deployment

Answer

ARP poisoning is the network attack being performed.
The correct option correctly identifies ARP poisoning. Gratuitous or unsolicited ARP replies that map a legitimate gateway IP address to a foreign MAC address are the definitive indicator of ARP cache poisoning, allowing an attacker to intercept or modify local network traffic.

Step-by-Step Solution

1
Analyze the log entries for protocol indicators.
The logs show unsolicited ARP (Address Resolution Protocol) replies linking the default gateway IP address (192.168.1.1) to a different MAC address (00:11:22:AA:BB:CC).
Address Resolution Protocol resolves IP addresses to Layer 2 MAC addresses.
2
Evaluate the impact of unsolicited (gratuitous) ARP replies.
Hosts on the local subnet accept the bogus ARP reply and update their internal ARP cache tables.
Gratuitous ARP broadcasts force targeted hosts to associate the gateway's IP address with the attacker's network interface.
3
Correlate the attack vector with the observed rerouting behavior.
Outbound subnet traffic destined for the gateway is sent directly to the attacker's MAC address, establishing an on-path position.
This signature precisely defines an ARP cache poisoning (ARP spoofing) attack.

Key Concept

ARP Cache Poisoning / ARP Spoofing
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic