Examkin

Soru

Zorluk: OrtaCommon Network Attack Types and Vectors

A network administrator discovers that a managed switch has begun flooding unicast frames out of all physical ports within a specific VLAN, causing the switch to degrade to hub-like behavior. Packet captures reveal a high volume of traffic originating from a single host port, containing randomized, rapidly changing source MAC addresses that exhaust the switch's Content Addressable Memory (CAM) table capacity. Which of the following attack types is taking place?

  1. MAC floodingCevap
  2. B
    ARP poisoning
  3. C
    DNS cache poisoning
  4. D
    SYN flooding

Cevap

MAC flooding
MAC flooding involves generating thousands of valid frames with unique, spoofed source MAC addresses from a single host port. This exhausts the limited memory capacity of the switch's Content Addressable Memory (CAM) table. Once full, the switch enters a fail-open state and floods all subsequent unicast frames out of every port in the VLAN, enabling an attacker to capture traffic intended for other nodes.

Adım Adım Çözüm

1
Analyze the observed network symptom.
The switch is sending unicast frames out of all ports in the VLAN and exhibiting hub-like behavior.
This occurs when a switch's CAM table is completely full and cannot map unknown destination MAC addresses to specific egress ports.
2
Examine the packet capture traffic pattern.
A high volume of frames with randomized source MAC addresses originates from a single physical port.
Rapidly injecting fake source MAC addresses forces the CAM table to overwrite legitimate entries until its memory limit is reached.
3
Correlate symptoms and traffic patterns with standard attack definitions.
The attack mechanism matches MAC flooding (CAM table overflow).
MAC flooding explicitly targets the Layer 2 switch CAM table capacity to intercept broadcasted unicast traffic.

Anahtar Kavram

MAC Flooding and CAM Table Exhaustion
Tahmini Süre:1m 30s
Bu soruyu puanla

Konular

Common Network Attack Types and Vectors

Bu konudan daha fazla soru