At a bank, a captured frame carries a source MAC that is not the MAC the switch learned for that IP yesterday. Which header in the frame contains the MAC address?
Select an answer to reveal the explanation.
Short Explanation
The return address is printed on the envelope, not inside the letter. You compare MAC addresses in the Ethernet header of the frame. The trap is hunting for that hardware address in TCP, DNS, or the HTTP host name.
Full Explanation
A MAC address is a layer-2 identifier carried on the frame. In an Ethernet frame the source and destination MAC addresses sit in the Ethernet header, which is the header you read when the switch's learned MAC for an IP no longer matches the frame. The header that contains the MAC is "The Ethernet header, the frame field that carries the source and destination MAC addresses". "The TCP header, where sequence numbers and port numbers sit ahead of the payload" carries ports, sequence numbers, and flags, not the station address the switch learned. "The DNS header, where the query name and the response code identify the lookup" identifies a name lookup, and a query name is not a MAC. "The HTTP Host header, where the client names the site it is trying to reach" is an application header naming a website, so it cannot be the field the switch stored as a MAC. Exam caveat: a mismatch between yesterday's MAC for an IP and today's source MAC is a clue to investigate, and it does not by itself name the person or the method. Operational check: compare the frame's source MAC with the switch MAC table and with the recorded MAC for that IP, and note the switch port where the frame arrived.