ITPEC FE Morning April 2019 Question 43
An attacker captures unencrypted network traffic with a tool and later analyzes it offline to learn about the information contained in those transmissions. Which of the following is this attack?
Explanation
Sniffing attack — capturing packets on a network and reading them later to extract the information they carry.
The attacker runs a packet capture tool (for example Wireshark or tcpdump) on a segment the traffic crosses, saves what passes, and analyses it offline. Anything sent in plaintext, such as passwords over Telnet or FTP, HTTP cookies or email contents, can be recovered. The attack is passive: it changes nothing, which makes it hard to detect.
Answer (d)
Why not others:
- •(a) Buffer overflow attack — writes more data than a buffer holds to overwrite memory and run the attacker's code; it targets a program, not traffic
- •(b) Phishing attack — tricks a person with a fake email or website into giving up credentials; nothing is captured from the network
- •(c) Smurf attack — sends ICMP echo requests to a broadcast address with the victim's spoofed source address so the replies flood the victim; a DoS attack, not eavesdropping
Key rule: Sniffing only works on readable traffic, so the countermeasure is encryption in transit (TLS, SSH, VPN), not access control.
Security · AI-written, may contain errors
This question comes from an official ITPEC past paper. ITPEC Practice is an independent study tool and is not affiliated with ITPEC. See the official FE past-paper collection or Report an issue.