CND (312-38) Network Defense Simulation

You are a Network Security Analyst monitoring the internal corporate LAN. You receive an alert from your Endpoint Detection and Response (EDR) system indicating a suspicious configuration change on a developer's workstation.

Simultaneously, the core switch logs show an abnormal volume of ARP replies originating from the same workstation's switchport. The attacker appears to be gathering intelligence and capturing cleartext credentials without interacting directly with the target servers.

EDR and Core Switch Event Logs

Analysis: The workstation interface has been placed in a state where it accepts all packets, not just those addressed to it. Combined with ARP spoofing, this forces the switch to send other users' traffic to this rogue port for interception.

Which of the following is a software tool used in passive attacks for capturing network traffic?

1. What is happening in the network

An attacker (or compromised host) on the internal network has initiated a passive attack. By placing the Network Interface Card (NIC) into promiscuous mode and utilizing ARP spoofing to manipulate the switch's CAM table, the host is forcing network traffic to flow through it. The attacker is silently capturing this traffic to extract sensitive data like cleartext passwords, without alerting the legitimate sender or receiver.

2. Identify attack or behavior

This is a classic passive reconnaissance and eavesdropping technique known as Packet Sniffing. Unlike active attacks (like DoS or exploitation) that alter system resources or disrupt services, passive attacks merely observe and record data in transit.

3. Why Option D is correct

Sniffer (also known as a packet analyzer or protocol analyzer, e.g., Wireshark, tcpdump) is the specific software tool used to capture, decode, and analyze network traffic in real-time. In the hands of an attacker, it is the primary weapon for passive traffic interception.

4. Why others are wrong

• A. Intrusion prevention system (IPS): An active defensive control that sits inline to block malicious traffic, not an offensive tool used for passive attacks.
• B. Intrusion detection system (IDS): A defensive monitoring tool. While an IDS does capture and analyze traffic (often using a sniffing engine underneath), in the context of network attacks, it is not the tool an attacker uses to conduct a passive attack.
• C. Warchalking: The physical act of drawing symbols on sidewalks or walls to indicate the presence and security status of an open Wi-Fi network. It is not a software tool.

5. Defensive action

To mitigate packet sniffing, Network Defenders must enforce encryption in transit (e.g., migrating from FTP/Telnet to SFTP/SSH, enforcing HTTPS, implementing IPsec). To prevent the associated local network manipulation, enable Dynamic ARP Inspection (DAI) and Port Security on switches to block rogue MAC addresses and ARP spoofing attempts. Use EDR to alert on unauthorized interfaces entering promiscuous mode.