MENU
During the intelligence gathering phase of a penetration test, you come across a press release by a security products vendor stating that they have signed a multi-million dollar agreement with the company you are targeting. The contract was for vulnerability assessment tools and network based IDS systems. While researching on that particular brand of IDS you notice that its default installation allows it to perform sniffing and attack analysis on one NIC and caters to its management and reporting on another NIC. The sniffing interface is completely unbound from the TCP/IP stack by default. Assuming the defaults were used, how can you detect these sniffing interfaces?
Suggested Answer: D
Get Premium CPEH-001 Questions
as Interactive Web-Based Practice Test or PDF
Real Exam Format
Detailed Explanations
Instant Access
Get Your Practice Test
When a Nic is set to Promiscuous mode it just blindly takes whatever comes through to it network interface and sends it to the Application layer. This is why they are so hard to detect. Actually you could use ARP requests and Send them to every pc and the one which responds to all the requests can be identified as a NIC on Promiscuous mode and there are some very special programs that can do this for you. But considering the alternatives in the question the right answer has to be that the interface cannot be detected.
39 comments · newest first
LU
Luz
11 months ago
I read somewhere that D might be true, but it seems unlikely.
RU
Rueben
11 months ago
Definitely C, that's a classic method!
DO
Dominga
11 months ago
Wait, the sniffing interface can't be detected? That sounds off.
JU
Julieta
12 months ago
Not sure about that, A could work too.
RI
Ricki
12 months ago
I think option B is the best way to detect it.
EL
Elliott
12 months ago
I vaguely remember that the sniffing interface is supposed to be unbound, which makes me think it might be hard to detect. Could option D be correct?
GE
Gerald
1 year ago
I’m a bit confused about the options. I feel like the sniffing interface should be detectable somehow, but I can't recall the exact method.
SU
Sue
1 year ago
I think I practiced a question similar to this where we had to identify how to interact with the IDS. Sending traffic might give us clues, right?
LA
Laurel
1 year ago
I remember something about using attack traffic to see if the IDS drops it, but I'm not sure if that's the best way to detect the sniffing interface.
BA
Basilia
1 year ago
I've got a strategy in mind. I'll focus on the details about the IDS configuration and try to come up with a way to detect the sniffing interface based on that information.
ME
Meaghan
1 year ago
I'm feeling a bit lost on this one. The different options don't seem very clear to me. I'll need to re-read the question and think it through step-by-step.
TI
Timmy
1 year ago
Hmm, I'm not sure about this one. The details about the IDS configuration have me a bit confused.
WI
Willodean
1 year ago
This question seems pretty straightforward. I think I can handle it.
ER
Erasmo
1 year ago
Okay, let me think this through. I'll need to carefully consider the information provided about the IDS setup and how to detect the sniffing interface.
VI
Vincent
1 year ago
This looks like a tricky question. I'll need to carefully review the details about the existing storage setup and the customer's requirements before deciding on the best approach.
BR
Brett
2 years ago
Haha, Option C is like something out of a cartoon. 'I'm the IDS, and I'm going to knock myself off the network!' Good one!
VI
Vincenza
2 years ago
Lisandra: That's true, using a ping flood could be effective.
AN
Antonio
2 years ago
I think Option A might be a more practical approach to detect the sniffing interface.
LI
Lisandra
2 years ago
Yeah, it does seem a bit unrealistic.
GO
Golda
2 years ago
Option C does sound pretty funny, like a cartoon!
HO
Howard
2 years ago
I'm going to have to go with Option A. Ping flooding the sniffing interface seems like the most reliable way to expose its existence.
JE
Jeffrey
2 years ago
Yeah, I would also choose Option A. It's a smart way to expose its existence.
JU
Jutta
2 years ago
Agreed, it seems like the most reliable way to detect the sniffing interface.
RO
Roslyn
2 years ago
I think Option A is the way to go. Ping flooding the sniffing interface sounds like a good plan.
MI
Mireya
2 years ago
I think D) The sniffing interface cannot be detected makes sense, as it is completely unbound from the TCP/IP stack by default.
RA
Ranee
2 years ago
Option C is just silly. Setting your IP to the IDS and expecting it to knock you off? That's not how it works, come on!
JA
Jaime
2 years ago
B) Send your attack traffic and look for it to be dropped by the IDS.
CH
Chantay
2 years ago
A) Use a ping flood against the IP of the sniffing NIC and look for latency in the responses.
AR
Arlene
2 years ago
D is probably the correct answer. The vendor likely designed the system to keep the sniffing interface hidden and undetectable.
KA
Kanisha
2 years ago
D) The sniffing interface cannot be detected.
ST
Stephaine
2 years ago
A) Use a ping flood against the IP of the sniffing NIC and look for latency in the responses.
NI
Nikita
2 years ago
I'm not sure, but I think C) Set your IP to that of the IDS and look for it as it attempts to knock your computer off the network could also work.
DI
Dierdre
2 years ago
I disagree, I believe the answer is B) Send your attack traffic and look for it to be dropped by the IDS.
NA
Na
2 years ago
I'm going with Option B. If the IDS is configured as described, it should drop any attack traffic, which would be a clear sign of the sniffing interface.
CH
Chana
2 years ago
I think the answer is A) Use a ping flood against the IP of the sniffing NIC and look for latency in the responses.
BE
Bette
2 years ago
Option A seems the most straightforward way to detect the sniffing interface. Sending a ping flood should reveal the latency in the responses, indicating the presence of the sniffing NIC.
BE
Bettina
2 years ago
C) Set your IP to that of the IDS and look for it as it attempts to knock your computer off the network.
LE
Lettie
2 years ago
B) Send your attack traffic and look for it to be dropped by the IDS.
AM
Amber
2 years ago
A) Use a ping flood against the IP of the sniffing NIC and look for latency in the responses.