Network and Perimeter Hacking · Topic 1 of 9
Sniffing, MAC, DHCP and ARP Attacks
Learn how packet sniffing works, then recognize MAC flooding, DHCP starvation and rogue servers, and ARP poisoning, with the controls that stop each one.
- 5 min
- Includes a diagram
- Passive sniffing works on hubs. Active sniffing is needed on switches.
- MAC flooding fills the CAM table so the switch acts like a hub. Port security is the fix.
- DHCP starvation exhausts the pool, and a rogue DHCP server then supplies false settings. DHCP snooping is the fix.
What it is
Sniffing is capturing the packets that cross a network and reading them. A sniffer puts the network card into promiscuous mode so it accepts frames not addressed to it. Anything sent in cleartext, such as passwords and session data, can then be read.
The three attacks on this page are the classic ways to make a switched network deliver other people's traffic to the attacker: flood the switch, hand out false addresses, or lie about who owns an IP address.
How it works
Sniffing concepts
| Type | Where it works | Notes |
|---|---|---|
| Passive sniffing | Hubs or a shared medium | Attacker only listens. A hub repeats every frame to every port, so no tricks are needed |
| Active sniffing | Switched networks | A switch sends frames only to the right port, so the attacker must inject traffic or manipulate the switch |
Protocols that send data in cleartext are the targets: HTTP, Telnet, FTP, rlogin, POP3, IMAP, SMTP, NNTP and SNMPv1/v2. Their encrypted replacements (HTTPS, SSH, SFTP, IMAPS and SNMPv3) resist sniffing. A SPAN (mirror) port and a network tap are legitimate ways to copy traffic for monitoring, and lawful interception uses the same idea under a legal order.
MAC attacks
A switch keeps a content addressable memory (CAM) table that maps MAC addresses to ports.
- MAC flooding: the attacker sends a huge number of frames with fake source MAC addresses until the CAM table is full. The switch can then fail open and behave like a hub, so it broadcasts frames to all ports. macof (from the dsniff suite) is the usual tool.
- MAC spoofing (cloning): the attacker copies another device's MAC address to receive its traffic or to bypass MAC filtering.
- Countermeasures: port security (limit the MAC addresses per port and set a violation action such as shutdown), 802.1X port based authentication, and sticky MAC addresses.
DHCP attacks
DHCP gives clients an IP address, gateway and DNS server. It uses UDP port 67 on the server and 68 on the client. The four message exchange is Discover, Offer, Request, Acknowledge.
| Attack | What happens |
|---|---|
| DHCP starvation | The attacker requests addresses with many spoofed MAC addresses until the pool is empty, so legitimate clients get no address. Tools include Yersinia and DHCPstarv |
| Rogue DHCP server | The attacker answers clients with their own gateway and DNS settings, which puts the attacker on the path of the traffic |
Starvation is often the first step because a depleted real server leaves the rogue server as the only one that answers. Both are countered by DHCP snooping, where the switch marks ports as trusted (the real server) or untrusted (everything else) and drops server messages from untrusted ports. Port security limits the spoofed MAC addresses that starvation needs.
ARP poisoning
ARP maps an IP address to a MAC address on the local segment. It has no authentication, and hosts accept unsolicited (gratuitous) replies.
In ARP poisoning (ARP spoofing) the attacker sends false ARP replies that tie the attacker's MAC address to the gateway's IP address. Victims then send their traffic to the attacker, who forwards it so nothing looks broken. This is a man in the middle (on-path) position.
Tools include Ettercap, Bettercap, arpspoof (from dsniff) and Cain and Abel. ARP poisoning only works inside one broadcast domain, so the attacker must already be on the local network.
Countermeasures:
- Dynamic ARP Inspection (DAI): the switch checks ARP packets against the DHCP snooping binding table and drops invalid ones.
- Static ARP entries for critical hosts such as the gateway.
- Port security and network segmentation to limit the broadcast domain.
- Encryption (TLS, SSH, IPsec), so intercepted data is unreadable.
A worked example
Users on one floor report that the network is slow, and the switch log shows thousands of new MAC addresses in a few seconds on one port. This is MAC flooding. Enabling port security with a maximum of a few addresses per port, and shutting down on violation, closes the hole.
How the exam asks about this
- "A switch begins forwarding all frames out every port after an attacker sends many frames with random source addresses. What is the attack?" -> MAC flooding (CAM table overflow).
- "Which switch feature stops a rogue DHCP server?" -> DHCP snooping with trusted ports.
- "Which control validates ARP packets against the DHCP binding table?" -> Dynamic ARP Inspection.
What to remember for the exam
- Passive sniffing works on hubs. Active sniffing is needed on switches.
- MAC flooding fills the CAM table so the switch acts like a hub. Port security is the fix.
- DHCP starvation exhausts the pool, and a rogue DHCP server then supplies false settings. DHCP snooping is the fix.
- ARP poisoning uses unsolicited ARP replies and works only on the local segment. DAI is the fix.
- Encrypted protocols make captured traffic useless even when sniffing succeeds.
Do not confuse MAC flooding (fills the switch table) with ARP poisoning (lies about an IP to MAC mapping). One makes the switch broadcast, the other redirects specific victims.
Common mistakes
Thinking a switch stops sniffing. A switch limits what a normal port sees, but flooding, ARP poisoning or a mirror port bring the traffic back.
Mixing up starvation and rogue server. Starvation takes addresses away. A rogue server hands out false ones.
Believing ARP poisoning works across routers. ARP is not routed, so the attacker has to be on the same segment.
Check yourself
What does a switch do when its CAM table is full of fake entries?
It can fail open and flood frames out all ports like a hub, letting the attacker sniff them.
Which two DHCP attacks does DHCP snooping address?
DHCP starvation, through limiting untrusted ports, and rogue DHCP servers, by dropping server replies from untrusted ports.
Why is ARP poisoning limited to the local network?
ARP works only inside a broadcast domain and is not forwarded by routers.
Topic 1 of 9 in Network and Perimeter Hacking
Test yourself on Network and Perimeter Hacking
The full EC-Council 312-50 question bank has 1,000 questions, with timed practice exams and an explanation for every answer.
This study guide is independent and is not affiliated with, endorsed by, or sponsored by EC-Council. Vendor names, certification names and exam codes are trademarks of their respective owners and are used for identification only.