CND (312-38) Network Defense Simulation

Network Scenario

You are a Network Security Analyst monitoring an internal subnetwork used by system administrators. This legacy subnet still relies on several unencrypted protocols for internal file transfers and router configurations.

Your Endpoint Detection and Response (EDR) platform generates a low-level alert for a compromised analyst workstation (10.0.8.45). The alert indicates anomalous network interface behavior. To understand the risk, you review the host telemetry and a sample of the network traffic captured during the incident. The attacker appears to be passively collecting sensitive data traversing the local switch.

Traffic & Logs

Question

Hint: Look at the EDR alert. The network interface entered "promiscuous mode." What type of tool requires promiscuous mode to read all passing packets without altering them?

Expert Analysis

1. What is happening in the network

An attacker has compromised an internal workstation and placed its Network Interface Card (NIC) into promiscuous mode. By doing so, the attacker's machine is silently capturing all frames broadcasted or flooded across the local switch segment. As shown in the PCAP snippet, the attacker successfully harvested cleartext FTP and Telnet credentials passively.

2. Identify attack or behavior

This is a classic Passive Eavesdropping / Network Sniffing attack. The attacker is not injecting traffic, spoofing MAC addresses (yet), or disrupting services; they are simply listening to traffic that arrives at their network interface.

3. Why correct answer is correct

C. Sniffer is correct. A sniffer (like Wireshark, tcpdump, or tshark) is a tool used to capture and log network traffic passing over a digital network. In the context of an attack, it is considered a passive tool because it only reads the data and does not modify or inject packets into the stream.

4. Why others are wrong

• A & B (IPS / IDS): While an IDS/IPS captures network traffic for analysis, they are defensive security controls, not offensive attack tools.
• D (warchalking): This is a physical reconnaissance technique where symbols are drawn (in chalk) in public spaces to indicate the presence and security status of an open wireless network. It is not a tool for capturing traffic.

5. Defensive action

Because passive sniffing generates no anomalous network traffic of its own, it is incredibly difficult to detect at the network layer. The primary defense is Encryption. If all internal traffic uses strong cryptography (e.g., SSH instead of Telnet, SFTP instead of FTP, HTTPS instead of HTTP), the captured PCAP is useless to the attacker. Secondarily, Host-based Intrusion Detection Systems (HIDS) or EDR should be configured to alert anytime an interface enters promiscuous mode unexpectedly.