During an incident investigation on an enterprise wired subnet, a security analyst reviews endpoint logs and network traffic captures. The log entries reveal that the MAC address bound to the default gateway IP address () is rapidly oscillating between the legitimate router physical address () and an unknown physical address (). This address flipping is accompanied by a continuous flood of unsolicited Gratuitous ARP reply packets broadcast across the local segment. Which of the following network attacks is currently taking place?
- ARP cache poisoningCevap
- BMAC flooding
- CDNS cache poisoning
- DRogue IPv6 router advertisement
Cevap
ARP cache poisoning is occurring because unsolicited Gratuitous ARP reply packets are corrupting the Layer 2 resolution tables of hosts by repeatedly re-mapping the gateway IP to an unauthorized MAC address.
The correct answer identifies ARP cache poisoning. In an ARP cache poisoning (ARP spoofing) attack, an adversary sends forged, unsolicited Gratuitous ARP reply messages across a local area network. Neighboring endpoints parse these replies and update their local ARP caches, overwriting the legitimate default gateway MAC address () with the attacker's MAC address (). This enables an On-Path (Man-in-the-Middle) attack by routing all external client traffic through the attacker's host.
Adım Adım Çözüm
Anahtar Kavram
ARP Cache Poisoning and Gratuitous ARP Indicators