Workstations at a branch suddenly send their internet traffic to a laptop. A capture shows repeated gratuitous ARP replies binding the gateway's IP address to the laptop's MAC address. Which attack is that?
Select an answer to reveal the explanation.
Short Explanation
ARP is the little directory that says which physical seat belongs to an IP address. You can see this laptop shouting that the gateway's seat is its own, and the workstations believe it, which is ARP poisoning. A rogue DHCP server can also point people at the wrong gateway, and it does that in a lease, not in the gratuitous ARP this capture shows.
Full Explanation
Hosts learn the MAC address for a local IP by ARP. A gratuitous ARP reply that pairs the gateway's IP address with the laptop's MAC overwrites that learning, so workstations encapsulate internet-bound frames to the laptop. That false binding is ARP poisoning, also called ARP spoofing when the attacker is deliberately publishing the lie. The laptop can then inspect, drop, or forward the traffic. A rogue DHCP server is the near miss, because it can also make the laptop the gateway. It does that by answering a discover with a lease, and the capture shows gratuitous ARP, not a DHCP offer. DNS cache poisoning inserts a false name-to-address record in a resolver. The capture is an ARP reply about a local IP, not a DNS response about a name. MAC flooding overflows the switch's MAC address table until unknown unicasts are flooded. That lets an attacker sniff traffic the switch should have forwarded to one port, and it does not rebind the gateway's IP to the laptop. Exam caveat: the switch may still show the gateway's real MAC on the router port while hosts hold the poisoned entry. Check both the host ARP cache and the switch table. Operational check: on an affected workstation, display the ARP entry for the gateway and confirm the MAC is the router's, then look for the source of the gratuitous replies on the switch port that learned the laptop.