Question:

Machine A (MAC address 00-01-02-AA-BB-CC) and Machine B (MAC address 00-01-02-BB-CC-DD) are on the same subnet. Machine C is on a different subnet and has the address 00-01-02-CCDD-EE. Machine B delivers a communication to Machine C while the attacker is sniffing on the fully switched network. Which of the following conditions would be required for an attacker on Machine A to get a copy of this message?

A The ARP cache of Machine B would need to be poisoned, changing the entry for the default gateway to 00-01-02-AA-BB-CC.

explanation

ARP poisoning is performed on the computer that generates the frame - the sender. When the sender machine's default gateway entry is changed, all packets destined for an IP address outside the subnet are routed to the attacker. It is pointless to change the ARP cache on the other machine or the router.

Related Information