At a retailer, an ARP reply tells the switch that the gateway IP address belongs to a cash-register MAC, and no ARP request was seen. Which artifact is that reply?
Select an answer to reveal the explanation.
Short Explanation
You’ve spotted an unsolicited ARP reply: it binds the gateway IP to a cash-register MAC even though nobody requested it. A DHCP renewal refreshes a lease, a DNS CNAME aliases a name, and a TLS ClientHello opens a handshake; none makes that IP-to-MAC claim.
Full Explanation
An ARP reply that nobody requested, mapping the gateway IP to a cash-register MAC, is cache poisoning aimed at the gateway. The artifact is an unsolicited ARP reply that claims the gateway IP is at a cash-register MAC for spoofing. A normal DHCP renewal, a client refreshing a lease it already holds from the local server, refreshes a lease; it does not announce the gateway’s IP at a register MAC. A DNS CNAME, an alias that points one name at another name and carries no hardware address, is a name alias with no MAC. A TLS ClientHello, the opening of a handshake rather than a mapping of an IP to a MAC, starts encryption setup and does not update an ARP cache. A lease refresh, a name alias, and a handshake opening do not rewrite the switch’s mapping of the gateway address. Exam caveat: a host may send an unsolicited ARP announcement for its own address during failover; a cash-register MAC claiming the gateway IP is the spoofing case, so confirm that MAC is not a known gateway interface. Operational check: compare the reply’s sender MAC with the gateway’s known MAC, and look for the same reply repeated toward other registers.