Q: 8
[Introduction to Incident Handling and Response]
Darwin is an attacker residing within the organization and is performing network
sniffing by running his system in promiscuous mode. He is capturing and viewing all
the network packets transmitted within the organization. Edwin is an incident handler
in the same organization.
In the above situation, which of the following Nmap commands Edwin must use to
detect Darwin’s system that is running in promiscuous mode?
Options
Discussion
C or D tbh. C is for sniffers but 'hostmap' in D maps hosts, which could theoretically be used to find devices in odd modes if you parse the results creatively. I think C is more direct but D feels tempting if you just skim the question. Anyone else see a reason to pick D?
For me, C since the sniffer-detect script is specifically designed to find NICs in promiscuous mode. But do we know if Edwin has credentials or special network access? If the tool needs elevated privileges on target machines, the answer could shift.
It's C-sniffer-detect is made for spotting NICs in promiscuous mode, which is what you need here. D is a map script, not for promiscuous detection. Pretty sure about C unless the network blocks that scan.
I see why people pick C, since sniffer-detect is meant for finding systems in promiscuous mode. D is more about mapping, doesn't really help with sniffers directly. Leaning C here but willing to hear other arguments.
C makes sense here since
-script=sniffer-detect is designed to spot promiscuous mode, which is what the attacker’s using. D just maps hosts but won’t actually help with sniffer detection. Pretty sure it’s C but open to other takes.D . Hostmap is tempting but it's a trap since the question asks for sniffers, which fits C better. Agree?
C but a bit unsure since some sources say hostmap for mapping and sniffer-detect for this use case.
My vote is C, saw similar on official practice and the nmap script sniffer-detect is made for this. Official guide covers those scripts too.
Not sure but I'd pick D.
Seen similar in practice tests, C is the type of nmap script for this situation.
Be respectful. No spam.
