Question

Jennifer is a junior system administrator for a small firm of 50 employees. For the last week a few users have been complaining of losing connectivity intermittently with no suspect behavior on their part such as large downloads or intensive processes. Jennifer runs Wireshark on Monday morning to investigate. She sees a large amount of ARP broadcasts being sent at a fairly constant rate. What is Jennifer most likely seeing?

Answer 1

Jennifer most likely seeing ARP Poisoning .

Explanation:

ARP or Address Resolution Protocol poisoning refers to when an attacker uses his devices to send falsified ARP messages over a LAN in order to link the attacker’s MAC Address with the IP addresses of one or more legitimate computers on the server.

Through this, the attacker is able to receive any message the legitimate computer received as well, allowing the attacker to block, modify or even intercept the communications of the legitimate computer on the server. The symptoms shown in the case here, showing intermittent connection losses even though no large downloads are taking place.