Module 08: Sniffing

Question 1

How can you configure a NIC to process frames not addressed to you?

Answer 1

Promiscuous mode enables a NIC to process frames not directly addressed to it.

• Normal Mode: By default, a NIC only processes frames addressed to its own MAC address or broadcast frames meant for everyone.
• Promiscuous Mode: When you enable promiscuous mode, the NIC will capture all frames on the network segment, regardless of the destination MAC address.

This mode is essential for sniffing and packet analysis because it allows tools like Wireshark or tcpdump to capture all network traffic that reaches the NIC, not just traffic specifically meant for that device.

Enabling promiscuous mode is helpful for network diagnostics, security monitoring, and packet analysis, allowing you to see all data flowing on the network segment, which is essential for effective sniffing. Here you process every frame we see without discrimination.

Question 2

MAC Flooding

Answer 2

Overloads a network switch’s MAC address table with fake addresses, causing it to broadcast all traffic; tools like macof can be used.

Question 3

DNS Poisoning

Answer 3

Redirects users to malicious sites by corrupting DNS records with fake IP addresses; dnsspoof and Ettercap are common tools.

Question 4

ARP Poisoning

Answer 4

Alters the ARP cache of network devices to redirect traffic through an attacker’s device, often performed using arpspoof or Ettercap.

Question 5

DHCP attacks

Answer 5

Exploits DHCP to assign incorrect IP information, often to hijack network traffic; Yersinia can execute DHCP starvation or rogue DHCP attacks.

DHCP starvation is an attack that exhausts the available IP addresses in a network’s DHCP pool by flooding the DHCP server with numerous fake DHCP requests. Each request appears to come from a unique, random MAC address, causing the server to allocate all its IP addresses to non-existent devices.

Purpose of DHCP Starvation
This attack can:

Prevent legitimate devices from obtaining an IP address, effectively blocking them from accessing the network.
Be a precursor to a rogue DHCP server attack, where the attacker sets up a fake DHCP server to control IP assignments and intercept traffic.
Common Tools
Yersinia and dhcpstarv are often used to perform DHCP starvation attacks by automating the flood of DHCP requests.

Question 6

Switch port stealing

Answer 6

Tricks a switch into forwarding traffic to the attacker by sending fake MAC addresses, typically performed with macof.

Question 7

Spoofing attack (impersonation)

Answer 7

Impersonates another device or user by faking IP or MAC addresses to gain unauthorized access; tools like hping3 and Scapy facilitate spoofing.