An attacker constructs forged ARP requests and replies to overload a switch's ARP processing. What is this attack called?

An attacker constructs forged ARP requests and replies to overload a switch's ARP processing. What is this attack called?

• A. ARP spoofing
• B. MAC flooding
• C. Passive sniffing
• D. Active sniffing

Answer: (A)

ARP spoofing is when an attacker sends forged ARP messages to poison the local ARP caches, making devices associate the attacker’s MAC address with legitimate IP addresses (often the gateway). By flooding the ARP cache with bogus entries, traffic can be redirected or the ARP processing on devices and switches can be overwhelmed. In this scenario, using forged ARP requests and replies to overload a switch’s ARP processing directly points to ARP spoofing (also called ARP poisoning). This differs from MAC flooding, which targets the switch’s MAC address table to force broadcasting, and from sniffing, which is about listening (passive) or actively manipulating traffic for interception without forging ARP entries.

ARP spoofing is when an attacker sends forged ARP messages to poison the local ARP caches, making devices associate the attacker’s MAC address with legitimate IP addresses (often the gateway). By flooding the ARP cache with bogus entries, traffic can be redirected or the ARP processing on devices and switches can be overwhelmed. In this scenario, using forged ARP requests and replies to overload a switch’s ARP processing directly points to ARP spoofing (also called ARP poisoning). This differs from MAC flooding, which targets the switch’s MAC address table to force broadcasting, and from sniffing, which is about listening (passive) or actively manipulating traffic for interception without forging ARP entries.