Users on the office wireless network see certificate warnings on well-known sites. A traceroute shows an extra hop through an unfamiliar internal host, and the ARP table maps the default gateway's IP address to a workstation's MAC address. Which attack is indicated?

An on-path attack places the attacker between two communicating parties so that traffic passes through a system the attacker controls. On a local network this is commonly achieved through ARP spoofing: the attacker's machine announces that the gateway's IP address belongs to its own MAC address, so hosts send outbound traffic to it. Indicators include the gateway's IP mapping to an unexpected MAC address, an extra hop in traceroute output and certificate warnings, because the attacker cannot present valid certificates for sites it tries to intercept. A distributed denial-of-service attack overwhelms resources to cause an outage; it would degrade or block traffic rather than reroute it through another host with certificate errors. DNS cache poisoning would cause names to resolve to wrong addresses, but it would not change the gateway's ARP entry or insert a hop into all traffic regardless of destination. A replay attack resends captured authentication data to gain access, which does not explain rerouted traffic or altered ARP tables. Exam caveat: users clicking through certificate warnings is how many on-path attacks succeed, so warnings deserve investigation rather than dismissal. Operational check: locate the switch port of the offending MAC address, isolate the workstation, enable dynamic ARP inspection, and confirm the gateway's ARP entry is correct on affected hosts.