Free Preparation Discussions
MENU
Cisco 350-701 Exam - Topic 6 Question 124 Discussion
Topic #: 6
[Security Concepts]
Which IPS engine detects ARP spoofing?
The Atomic ARP engine is a signature engine that defines basic Layer 2 ARP signatures and provides more advanced detection of the ARP spoof tools dsniff and ettercap. ARP spoofing is an attack that involves sending spoofed ARP messages over a local area network to associate the attacker's MAC address with the IP address of the target. The Atomic ARP engine inspects the Layer 2 ARP protocol and compares the ARP requests and replies with the MAC address table to detect any anomalies or inconsistencies. The Atomic ARP engine can also detect gratuitous ARP messages, which are unsolicited ARP replies that can be used to poison the ARP cache of other hosts.The Atomic ARP engine is different from other IPS engines because most engines are based on Layer 3 IP protocol.Reference:=
https://www.cisco.com/c/en/us/td/docs/security/ips/6-1/configuration/guide/cli/cliguide/cli_signature_engines.html
https://security.stackexchange.com/questions/71023/can-suricata-ips-detect-and-prevent-arp-poisoning-attacks
Elvera
3 days agoJenelle
8 days agoEllsworth
13 days agoFatima
19 days agoSonia
24 days agoNichelle
29 days agoLynette
1 month agoSelma
1 month agoLeigha
1 month agoValda
2 months agoNickie
2 months agoKindra
2 months agoYolando
2 months agoBelen
2 months agoTalia
4 months agoBok
4 months agoBrittni
4 months ago