Which activity involves monitoring network traffic without injecting or altering any packets?

Which activity involves monitoring network traffic without injecting or altering any packets?

• A. Active sniffing
• B. Passive sniffing
• C. ARP spoofing
• D. MAC flooding

Answer: (B)

Monitoring network traffic without injecting or altering packets is passive sniffing. The idea is to observe and capture frames as they move through the network, without sending any crafted packets or changing the flow of traffic. This often requires a network tap, a SPAN/mirror port on a switch, or placing a NIC into a suitable mode to listen to traffic not addressed to you. Because no traffic is injected or modified, the network's behavior remains unchanged and the activity is harder to detect. Active sniffing, by contrast, involves interacting with the network by sending packets or altering frames to elicit responses or to position the attacker in a man-in-the-middle setup. ARP spoofing is a concrete technique used to mislead devices about MAC-to-IP mappings, enabling interception or manipulation of traffic. MAC flooding overloads the switch's forwarding table to force broadcast of frames, disrupting normal switching behavior.

Monitoring network traffic without injecting or altering packets is passive sniffing. The idea is to observe and capture frames as they move through the network, without sending any crafted packets or changing the flow of traffic. This often requires a network tap, a SPAN/mirror port on a switch, or placing a NIC into a suitable mode to listen to traffic not addressed to you. Because no traffic is injected or modified, the network's behavior remains unchanged and the activity is harder to detect.

Active sniffing, by contrast, involves interacting with the network by sending packets or altering frames to elicit responses or to position the attacker in a man-in-the-middle setup. ARP spoofing is a concrete technique used to mislead devices about MAC-to-IP mappings, enabling interception or manipulation of traffic. MAC flooding overloads the switch's forwarding table to force broadcast of frames, disrupting normal switching behavior.