Certified Ethical Hacker (CEH) Practice Question

Passive sniffing relies on putting a network interface into promiscuous mode and silently listening for frames that arrive on the wire. On a legacy hub, every frame is seen by every port, so this is enough to capture all traffic. A modern switch, however, forwards unicast frames only to the specific port on which the destination MAC address resides, so a passive sniffer on another port will see only broadcasts and its own traffic. To force a switch to deliver someone else's packets to the attacker, the tester must turn to an active technique such as ARP spoofing/poisoning or MAC flooding, which manipulates the switch's CAM table and causes mis-forwarding or duplication of traffic to the attacker's port. Enabling full-duplex, relying on VLAN tagging, or activating port security will not by itself provide visibility into other stations' unicast traffic; nor is a hardware tap necessary if software-based Layer 2 attacks succeed.