CND (312-38) Network Defense Simulation
Analyze the provided network scenario and logs to identify the security threat. This exercise will sharpen your ability to detect passive reconnaissance and unauthorized traffic interception.
Network Scenario
You are a Network Security Analyst monitoring an enterprise LAN. Over the past 24 hours, the incident response team noticed that sensitive, unencrypted credentials belonging to an internal legacy FTP application were compromised. There are no signs of brute-force attacks, malware execution, or active exploitation on the FTP server itself.
While reviewing access switch configurations, you notice an unauthorized baseline deviation on a core switch, followed by host-level alerts from a nearby diagnostic workstation.
Traffic & Logs
Excerpt from Core Switch Syslog & Host IDS:
Question
Which of the following is a software tool used in passive attacks for capturing network traffic?
Expert Analysis
1. What is happening in the network
An attacker has gained administrative access to a core switch and configured a SPAN (Switched Port Analyzer) session. This configuration mirrors all traffic from VLAN 10 and sends it to interface Gi1/0/24. Simultaneously, a host connected to that network entered "promiscuous mode," meaning its network interface is now accepting all packets it receives, not just those addressed to its specific MAC address.
2. Identify attack or behavior
This is a classic passive reconnaissance/sniffing attack. The attacker is silently copying traffic off the wire to capture unencrypted data (like the legacy FTP credentials mentioned in the scenario) without interacting with the FTP server directly or altering the traffic flow.
3. Why the correct answer is correct
A. Sniffer: A packet sniffer (or protocol analyzer) like Wireshark, tcpdump, or Ettercap is the software tool explicitly designed to capture and analyze network traffic in real-time. In a passive attack, sniffers read data without injecting any new packets, making them incredibly difficult to detect purely from network flow alone.
4. Why others are wrong
- B. Intrusion detection system (IDS): While an IDS captures traffic to analyze it, it is a defensive tool used to detect anomalies and signatures, not an attack tool used to compromise data.
- C. Intrusion prevention system (IPS): An IPS is an active defensive control that sits inline to block malicious traffic. It is not used for passive eavesdropping.
- D. Warchalking: This is a physical act of drawing symbols on streets or walls to indicate the presence of an open Wi-Fi network. It is not a software tool.
5. Defensive action
To defend against unauthorized sniffing, network defenders should:
- Implement end-to-end encryption (e.g., replace FTP with SFTP, use TLS/IPsec). Even if traffic is captured, it will be unreadable.
- Utilize switch port security features: disable unused ports, restrict SPAN configurations to authorized administrative VLANs only.
- Deploy Network Access Control (NAC) to prevent unauthorized devices from connecting to switch ports.
- Monitor for unexpected MAC addresses or interfaces entering promiscuous mode via Endpoint Detection and Response (EDR) or Host IDS.
6. MINI LESSON: Passive vs Active Attacks
Traffic Pattern Recognition: Passive attacks (like sniffing) are notoriously difficult to detect because the attacker does not generate anomalous traffic volumes or interact with the target server. Detection relies heavily on configuration monitoring (e.g., unauthorized SPAN ports) and host-level logging (e.g., NIC promiscuous mode). Prevention via strong encryption is always preferred over attempting to detect passive eavesdropping.