4.0 Network and Perimeter Hacking CEH Practice Quiz

• A. MAC flooding sends frames with thousands of unique fake source MAC addresses, exhausting the switch's Content Addressable Memory (CAM) table, when full, many switches fail open and flood all frames out all ports (behaving like a hub), enabling passive sniffing
• B. MAC flooding fills the switch's CPU cache with fake MAC addresses, causing the switch to crash and reboot, creating a temporary network outage for denial-of-service purposes
• C. MAC flooding sends malformed frames with invalid MAC addresses, causing the switch's frame processing ASIC to generate error interrupts that crash the forwarding engine
• D. MAC flooding rapidly cycles the same MAC address across different switch ports, confusing the MAC learning algorithm and preventing legitimate frames from being forwarded

A MAC flooding attack (using tools like macof from the dsniff suite) sends frames with randomly generated fake source MAC addresses at high volume. The switch learns each new source MAC, adding it to the CAM table. When the CAM table reaches capacity, the switch can no longer learn new legitimate MAC-to-port mappings. Many switches (particularly older models) respond by 'failing open', flooding frames for unknown destination MACs out all ports, converting from unicast switching to hub-like broadcasting. An attacker connected to any switch port can now capture all traffic in the VLAN using promiscuous mode.

• A. Port Security, configures a maximum number of MAC addresses per port and defines violation actions (protect, restrict, shutdown) when the limit is exceeded
• B. 802.1Q VLAN tagging, limiting VLANs to one MAC address per port prevents CAM table overflow by enforcing strict per-VLAN MAC uniqueness
• C. DHCP Snooping, validates DHCP transactions and limits the number of IP addresses per port, indirectly preventing MAC address proliferation
• D. Dynamic ARP Inspection (DAI), validates ARP packets against the DHCP snooping binding table, limiting the MAC addresses that can perform ARP resolution per port

Cisco Port Security is specifically designed to prevent MAC flooding by limiting MAC address learning per port: (1) 'switchport port-security maximum 1' limits the port to 1 MAC address (for end-user access ports). (2) 'switchport port-security violation shutdown' disables the port if the limit is exceeded (most secure). (3) Alternative violations: 'restrict' (drops violating frames, sends SNMP trap) and 'protect' (silently drops violating frames). (4) 'switchport port-security mac-address sticky' dynamically learns and persists the first MAC seen. When macof generates thousands of fake MACs on a port with port-security maximum 1, the first fake MAC triggers a violation and the port shuts down, protecting other ports from the overflow attack.

• A. Promiscuous mode configures the NIC to accept and pass ALL frames on the wire to the OS, regardless of whether the destination MAC address matches the interface's own MAC, enabling packet capture of traffic destined for other hosts
• B. Promiscuous mode disables the network interface's hardware firewall, allowing all packet types including ICMP and UDP that are normally blocked by the NIC
• C. Promiscuous mode enables the network card to transmit at higher speeds, removing rate limiting to increase packet injection throughput during active attacks
• D. Promiscuous mode is a wireless-specific mode that enables monitoring of all 802.11 channels simultaneously, allowing passive capture of all Wi-Fi traffic within range

By default, a NIC in normal mode silently discards frames where the destination MAC address does not match its own MAC or the broadcast address (FF:FF:FF:FF:FF:FF). This prevents the host's CPU from processing traffic destined for other devices. In promiscuous mode, the NIC passes ALL frames seen on the wire/switch port to the operating system, including unicast frames destined for other hosts. Packet capture tools (Wireshark, tcpdump) require promiscuous mode to capture traffic not addressed to the local machine. Setting promiscuous mode: 'ip link set eth0 promisc on' (Linux) or programmatically via libpcap/WinPcap. Note: on switched networks, promiscuous mode only captures traffic on the same switch port without additional techniques (ARP poisoning, port mirroring).

• A. Configure SPAN (Switched Port Analyzer) / port mirroring, the switch copies all frames from the source port (or VLAN) to a designated mirror port where the monitoring station is connected
• B. Configure VTP (VLAN Trunking Protocol) pruning to exclude the monitored port from VLAN updates, VTP pruning redirects all pruned VLAN traffic to the monitoring station
• C. Configure STP (Spanning Tree Protocol) root bridge election on the monitoring station, the root bridge receives all broadcast traffic in the VLAN for analysis
• D. Configure DHCP snooping on the switch, DHCP snooping forwards all client traffic to the DHCP server port where the monitoring station can intercept it

SPAN (Switched Port Analyzer, also called port mirroring) is a switch feature specifically designed for non-intrusive traffic monitoring: (1) Source port(s) or VLAN(s) are defined, the switch copies all frames (ingress, egress, or both) from these sources. (2) Destination port is specified, the monitoring station connects here and receives copied frames. (3) The monitoring station captures all traffic without being inline, the original traffic path is unaffected. (4) Configuration example (Cisco): 'monitor session 1 source interface Gi0/1; monitor session 1 destination interface Gi0/24'. RSPAN (Remote SPAN) extends this across switches using a dedicated VLAN.

• A. Port Security is more robust, limiting MACs to 2 per port mathematically prevents all MAC flooding regardless of attacker sophistication, since 2 MAC addresses cannot flood a CAM table
• B. Both controls are equally robust, port security and 802.1X provide identical protection mechanisms that respond identically to sophisticated MAC flooding evasion techniques
• C. Neither control provides meaningful protection, MAC flooding is exclusively a physical layer attack that cannot be prevented by Layer 2 switch security features
• D. 802.1X NAC is more robust, port security's maximum 2 MACs per port can still be evaded by an attacker who generates exactly 2 fake addresses per port; 802.1X requires cryptographic authentication of each device before any MAC is learned, preventing unauthorized devices from sending frames that populate the CAM table regardless of MAC count manipulation

802.1X (IEEE 802.1X Port-Based Network Access Control) requires cryptographic EAP authentication before a port is authorized to pass data traffic: (1) When a device connects, the switch sends an EAP-Request to the supplicant (connecting device). (2) The device must authenticate using valid credentials (certificate, username/password via RADIUS). (3) Until authentication succeeds, the port is in 'unauthorized' state, no frames from the device are forwarded or learned into the CAM table. (4) An attacker cannot generate ANY MAC addresses into the CAM table without valid credentials, regardless of how many fake MACs they generate. 802.1X prevents unauthorized frame injection at the authentication level, making MAC flooding impossible for unauthenticated devices, a fundamentally stronger control than count-based limiting.

• A. arping -A -s 00:11:22:33:44:55 -I eth0 192.168.1.1, sends gratuitous ARP announcements from the specified source MAC
• B. nmap --script arp-spoof 192.168.1.50 --gateway 192.168.1.1. Nmap's built-in ARP spoofing script poisons the target's ARP cache
• C. arp -s 192.168.1.1 00:11:22:33:44:55, adds a static ARP entry to the local kernel ARP table for the gateway IP
• D. arpspoof -i eth0 -t 192.168.1.50 192.168.1.1, tells target 192.168.1.50 that 192.168.1.1 is at the attacker's MAC address (from the dsniff suite)

arpspoof (from the dsniff suite) is the standard tool for targeted ARP poisoning: 'arpspoof -i eth0 -t 192.168.1.50 192.168.1.1' sends ARP replies to 192.168.1.50 (-t target) claiming that 192.168.1.1 (the spoofed IP) is at the attacker's MAC address. The attacker's actual MAC (from eth0) replaces the legitimate gateway MAC in 192.168.1.50's ARP cache. To complete the MITM (bidirectional interception), a second arpspoof command is run in the other direction: 'arpspoof -i eth0 -t 192.168.1.1 192.168.1.50', poisoning the gateway's cache too.

• A. DAI should be enabled on trunk ports only, access ports are trusted by design since only authorized workstations connect to access ports
• B. The configuration is incorrect, DAI must be enabled identically on all port types (access and trunk) without distinction for it to provide any security benefit
• C. DAI should be disabled on all ports, ARP inspection creates processing overhead that degrades switch performance unacceptably for production environments
• D. Trunk ports should be configured as DAI-trusted interfaces, enabling DAI on trunk uplinks without trust configuration causes DAI to drop legitimate ARP frames from upstream routers, switches, and DHCP servers that are not in the DAI binding table, breaking valid network connectivity

Dynamic ARP Inspection validates ARP packets on untrusted ports by checking whether the ARP sender's IP-to-MAC mapping matches the DHCP snooping binding table. Trunk uplinks (connecting to routers, upstream switches, servers with static IPs) send legitimate ARP frames that may not have entries in the DHCP snooping binding table (because these devices use static IPs or are DHCP servers themselves, not DHCP clients). If DAI is enabled on trunk ports without 'ip arp inspection trust', DAI drops their ARP frames as 'invalid', breaking router connectivity and server ARP resolution. Correct configuration: 'ip arp inspection trust' on trunk uplinks and DHCP server ports; 'ip arp inspection' (untrusted, default) on access ports only.

• A. ARP poisoning, sending gratuitous ARP replies to both the workstation and gateway claiming the attacker's MAC is associated with each other's IP, causing both hosts to send traffic through the attacker's machine
• B. Increasing the NIC's buffer size, larger receive buffers allow the NIC to capture additional frames from adjacent switch ports
• C. DNS cache poisoning, redirecting the workstation's DNS queries to the attacker's resolver, which forwards all traffic through the attacker as a DNS proxy
• D. Enabling IPv6 on the attacker's interface, modern switches forward all IPv6 traffic in promiscuous mode regardless of destination MAC addresses

ARP poisoning (ARP spoofing) is the primary active sniffing technique for switched environments: (1) The attacker sends an ARP reply to the workstation (192.168.1.10) claiming MAC:attacker_mac is at IP:192.168.1.1 (the gateway). (2) The attacker sends an ARP reply to the gateway (192.168.1.1) claiming MAC:attacker_mac is at IP:192.168.1.10. (3) Both hosts update their ARP caches with the attacker's MAC for each other's IP. (4) Traffic from the workstation to the gateway is sent to attacker_mac, the attacker captures it, then forwards to the real gateway. (5) Return traffic from the gateway to the workstation similarly routes through the attacker. This creates a Man-in-the-Middle position without requiring any switch configuration access.