Exam CFR-310 topic 1 question 21 discussion

D. Promiscuous mode ensures the monitoring system captures ARP packets sent to all clients on the VLAN. No impact on the network infrastructure, as it’s a local setting on the monitoring machine. Easy to configure and requires no special permissions or changes to the network infrastructure. It is a simple switch in Wireshark or your network adapter’s settings Why the other answers are less suitable: A. Clear the ARP cache on their system: While this may help in identifying new ARP traffic, it doesn’t address the issue of potentially missing traffic not directed to the capturing system. B. Enable port mirroring on the switch: This could be helpful, but it’s more complex to set up. Overkill for this situation unless the network is highly segmented or complex.. C. Filter Wireshark to only show ARP traffic: helps focus on ARP traffic, but if the adapter is not in promiscuous mode, the system might still miss relevant packets.

The answer is B. Enable port mirroring on the switch. In this case, the administrator believes that a system on VLAN 12 is ARP poisoning clients on the network. However, they did not find any evidence of ARP poisoning after reviewing the capture file. This could be because the ARP poisoning is happening on a different port on the switch. By enabling port mirroring on the switch, the administrator can capture all traffic on VLAN 12, including ARP traffic, and look for evidence of ARP poisoning.