MAC Flooding for Switch Sniffing on CEH

Sniffing

In a large organization, a network security analyst discovered a series of packet captures that seem unusual. The network operates on a switched Ethernet environment. The security team suspects that an attacker might be using a sniffer tool. Which technique could the attacker be using to successfully carry out this attack, considering the switched nature of the network?

The attacker might be compromising physical security to plug into the network directly.
The attacker might be implementing MAC flooding to overwhelm the switch's memory. Correct Answer
The attacker is probably using a Trojan horse with in-built sniffing capability.
The attacker might be using passive sniffing, as it provides significant stealth advantages.

Answer Correct answer: B — The attacker implements MAC flooding to overwhelm the switch's CAM table, forcing it into fail-open mode to broadcast traffic for sniffing.

Community Votes

83%

17%

83% of anonymous learners picked answer B. Votes are pick records left by other test-takers — they are not the verified answer.

Community Insight

The scenario describes 'unusual packet captures' generated by the attack, which eliminates passive methods and highlights MAC flooding as the active technique used to bypass switch security.

This question explores how MAC flooding forces a switch into fail-open mode to enable network sniffing in switched environments. The analysis confirms that generating unusual traffic patterns points to active sniffing techniques like MAC flooding.

Learners often choose C or D because they assume sniffing is inherently passive; however, the presence of generated traffic (unusual packets) indicates an active attack like MAC flooding rather than a Trojan or passive monitoring.

Community Discussion (13 comments)

insaniunt 👍 5 Selected: B

I read once again the book: To summarize the types of sniffing: passive sniffing does not send any packets; it only monitors the packets sent by others. Active sniffing involves sending out multiple network probes to identify access points. The following is a list of different active sniffing techniques: ▪ MAC flooding - switch is vulnerable to active sniffing only. - Trojan horse is a passive sniffing methods Module 08 Page 1214

g_man_rap 👍 2

Option B, MAC flooding to overwhelm the switch's memory, is the most plausible technique that an attacker might use in a switched network environment to enable traffic sniffing broadly across the network. This method effectively makes the switch behave more like a hub, broadcasting traffic to all connected devices and thus enabling a sniffer to capture traffic not originally intended for the attacker’s connected device.

LordXander 👍 1 Selected: B

I would've gone with C/D because it makes more sense, however we have more packages than usual and C would fail because in sniffing you don't generate pakcages...you just inspect them. D...well, we see activity generated so it cannot be

mossj 👍 1 Selected: B

B: MAC flooding MAC flooding makes use of this limitation to bombard switches with fake MAC addresses until the switches can no longer keep up. Once this happens to a switch, it will enter fail-open mode, wherein it starts acting as a hub by broadcasting packets to all the ports on the switch.

qtygbapjpesdayazko 👍 1 Selected: B

The correct is B, MAC flooding, the keyword is "Which technique"

calx5 👍 1 Selected: B

MAC flooding for switch environment.

duke_of_kamulu 👍 2

according to the CEHv12 pg 1214 we have pasive n active but been an attack we see more packets flooded so we eliminate the possibility of it been a trajon horse "passively monitoring" to actively sniffing sothe ANSWER becomes B

athicalacker 👍 4 Selected: B

The key here is unusual packet captures. MAC flooding involves sending a large number of spoofed MAC addresses to a switch, causing it to enter into a state where it forwards traffic to all ports, effectively turning it into a hub-like device. This could result in a flood of traffic that might be detected as unusual by network monitoring tools.

przemyslaw1 👍 2 Selected: B

B. The attacker might be implementing MAC flooding to overwhelm the switch's memory. MAC flooding force the switch into a less secure fail-open mode.

insaniunt 👍 1 Selected: C

Using a Trojan horse: Most Trojans have in-built sniffing capability. An attacker can install these on a victim’s machine to compromise it. After compromising the victim’s machine, the attacker can install a packet sniffer and perform sniffing. Most modern networks use switches instead of hubs. A switch eliminates the risk of passive sniffing. However, a switch is still vulnerable to active sniffing. Note: Passive sniffing provides significant stealth advantages over active sniffing - Module 08 Page 1214

sogbe 👍 2 Selected: C

Important thing to note here is that in the question they say you have "Discovered a series of packet captures which seem unusual" it's not saying that the Security staff have run those network captures but that they have found files of packet captures having been run by a presumably unknown party. I would think one of the only real ways that you are going to have packet capture files left on PC's on your network is if those PCs have had capturing software installed on them covertly by a Trojan virus and that software is now running scans from the infected PCs. Once you understand that the Security staff is finding network scanner files and is not the one doing the scanning, the Trojan horse answer is the only one which makes sense here.

sogbe 👍 1

rorahir 👍 2

Ethical hacking specialists could you please check if this approach is correct"

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

The correct answer is B because MAC flooding is an active sniffing technique specifically designed to defeat the security of switched networks. By sending thousands of frames with different source MAC addresses, the attacker overwhelms the switch's Content Addressable Memory (CAM) table. Once the table is full, the switch enters a 'fail-open' state, behaving like a hub and broadcasting all traffic to every port, allowing the attacker to capture packets intended for other users.

Why the Other Options Are Wrong

Option A is incorrect because physical access is not required if the attacker is already on the network segment to perform MAC flooding. Option C is incorrect because while a Trojan could be used, it does not explain the 'unusual packet captures' caused by the flooding activity itself; the question asks for the technique causing the sniffing capability via the network anomaly. Option D is incorrect because passive sniffing does not generate any packets, so it would not result in the 'unusual' traffic described in the scenario.

Community Comment Notes

Community consensus strongly supports B, citing that MAC flooding creates the specific network anomalies mentioned. As one user noted, "MAC flooding force the switch into a less secure fail-open mode." Another clarified that "we see more packages flooded so we eliminate the possibility of it been a trajon horse" because passive tools do not generate traffic. Users emphasized that the keyword 'unusual' implies active generation of traffic, ruling out passive options.

Exam Strategy

When a question mentions 'switched environment' and 'sniffing', look for active attacks that manipulate switch behavior, such as MAC flooding or ARP poisoning. If the scenario mentions 'unusual traffic' or 'packets generated', it indicates an active attack, ruling out passive sniffing.

Frequently Asked Questions

Why is MAC flooding considered active sniffing?

It involves sending many spoofed frames to flood the switch, generating visible network traffic that alters switch behavior.

Can passive sniffing work on a switched network?

No, switches isolate traffic to specific ports, preventing passive sniffers from seeing unrelated traffic unless the switch is compromised or misconfigured.

More 312-50v12 FAQ →

Related Analysis

← Back to 312-50v12 Study Guide