Examkin

Question

Difficulty: EasyNetwork and Wireless Attack Indicators

A network security administrator monitoring enterprise switch logs notices that a single Media Access Control (MAC) address is rapidly alternating between two different physical switch ports. This constant port-flapping anomaly is causing frame misdirection across the local subnet. Which of the following attack types is most likely occurring?

  1. MAC spoofingAnswer
  2. B
    ARP poisoning
  3. C
    DNS cache poisoning
  4. D
    Radio frequency jamming

Answer

The attack indicated by the rapid alternation of a single MAC address across multiple switch ports is MAC spoofing.
MAC spoofing occurs when an attacker modifies their network interface MAC address to mirror an authorized device. Transmitting traffic from two devices using identical MAC addresses forces the network switch to continuously rebind the MAC address to different ports, generating port-flapping indicators in syslog.

Step-by-Step Solution

1
Analyze the observed log indicator.
Identified MAC address table flapping, where a single physical MAC address is learned on two separate switch ports in rapid succession.
Ethernet switches dynamically map learned source MAC addresses to specific ingress ports in their forwarding tables.
2
Match the indicator to the corresponding Layer 2 network attack.
Duplicate MAC addresses active on separate ports cause the switch to constantly overwrite port assignments for that address.
This behavior directly points to a MAC spoofing scenario where an attacker duplicates an authorized machine's MAC address.

Key Concept

MAC Spoofing Indicators
Estimated Time:45s
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic