Which tool, listed here, is used to flood the local network with random MAC and IP addresses to facilitate sniffing?

Which tool, listed here, is used to flood the local network with random MAC and IP addresses to facilitate sniffing?

• A. arp spoof
• B. ettercap
• C. macof
• D. Wireshark

Answer: (C)

Mac flooding, also known as CAM table overflow, is the technique at work here. macof is a tool specifically designed to flood a switch with frames that have random source MAC addresses (and often random IPs too). When the switch’s CAM (content-addressable) table fills up with these fake addresses, it can’t learn which port belongs to which device, so it starts broadcasting frames to all ports. That means traffic from many devices can be seen on the attacker’s port if their NIC is in promiscuous mode, making sniffing possible on a switched network. Other options are about manipulating address mappings to perform a man-in-the-middle, or simply capturing traffic without causing the flood. ARP spoofing and tools like Ettercap focus on poisoning ARP tables to redirect traffic, not overwhelming the switch’s MAC table. Wireshark is a passive packet analyzer and doesn’t perform any flooding to enable sniffing.

Mac flooding, also known as CAM table overflow, is the technique at work here. macof is a tool specifically designed to flood a switch with frames that have random source MAC addresses (and often random IPs too). When the switch’s CAM (content-addressable) table fills up with these fake addresses, it can’t learn which port belongs to which device, so it starts broadcasting frames to all ports. That means traffic from many devices can be seen on the attacker’s port if their NIC is in promiscuous mode, making sniffing possible on a switched network.

Other options are about manipulating address mappings to perform a man-in-the-middle, or simply capturing traffic without causing the flood. ARP spoofing and tools like Ettercap focus on poisoning ARP tables to redirect traffic, not overwhelming the switch’s MAC table. Wireshark is a passive packet analyzer and doesn’t perform any flooding to enable sniffing.