Which sniffing technique uses MAC flooding to sniff the packets by forging ARP packets with the target MAC address as the source and the attacker's MAC address as the destination?

Which sniffing technique uses MAC flooding to sniff the packets by forging ARP packets with the target MAC address as the source and the attacker's MAC address as the destination?

• A. Port security
• B. switch port stealing
• C. macof
• D. CAM table

Answer: (B)

The situation hinges on how a switch handles destination addresses when its CAM table is overwhelmed. Flooding the CAM table with many fake MACs forces the switch to stop learning precise port mappings and start broadcasting unknown unicast frames to all ports. If an attacker also forges ARP replies that tie the target’s MAC to the attacker’s MAC, the broadcasted traffic can be steered toward the attacker’s port, allowing sniffing of the target’s packets. This combination of exhausting the CAM table and manipulating ARP mappings to capture traffic is a classic switch port stealing technique. It’s the term that best describes turning a switched network into a sniffable environment by hijacking the switch’s forwarding behavior, rather than a defensive feature (port security) or just naming a tool or a table (CAM table).

The situation hinges on how a switch handles destination addresses when its CAM table is overwhelmed. Flooding the CAM table with many fake MACs forces the switch to stop learning precise port mappings and start broadcasting unknown unicast frames to all ports. If an attacker also forges ARP replies that tie the target’s MAC to the attacker’s MAC, the broadcasted traffic can be steered toward the attacker’s port, allowing sniffing of the target’s packets. This combination of exhausting the CAM table and manipulating ARP mappings to capture traffic is a classic switch port stealing technique. It’s the term that best describes turning a switched network into a sniffable environment by hijacking the switch’s forwarding behavior, rather than a defensive feature (port security) or just naming a tool or a table (CAM table).