When bypassing a switch by sending an IP packet with the ACK bit and spoofed source address, what is the attacker attempting?

When bypassing a switch by sending an IP packet with the ACK bit and spoofed source address, what is the attacker attempting?

• A. Trick the switch into thinking it already has a session with Terri's computer
• B. Enable tunneling feature on the switch
• C. Crash the switch with a DoS attack since switches cannot send ACK bits
• D. Poison the switch's MAC address table by flooding it with ACK bits

Answer: (A)

The scenario tests how spoofing combined with TCP control flags can exploit how a switch handles an existing session. By sending an IP packet with the ACK bit set and a spoofed source address, the attacker pretends there is an already established TCP session with Terri’s computer. Switches rely on learning and using the mapping of addresses from observed traffic to decide where to forward replies. If the switch believes there’s an active session associated with Terri’s IP, it may route responses toward the attacker’s port, effectively hijacking or intercepting the session. That’s why the aim is to trick the switch into thinking Terri’s computer is involved in a live session on the attacker’s side. The other options describe different ideas not aligned with this technique: enabling a tunneling feature isn’t what this spoofed-ACK method seeks to do; switches can handle and forward ACKs, so a DoS rationale based on “switches cannot send ACKs” is incorrect; and MAC table poisoning by flooding with ACKs describes a MAC flooding approach, not the session-hijacking angle produced by a spoofed ACK indicating an existing session.

The scenario tests how spoofing combined with TCP control flags can exploit how a switch handles an existing session. By sending an IP packet with the ACK bit set and a spoofed source address, the attacker pretends there is an already established TCP session with Terri’s computer. Switches rely on learning and using the mapping of addresses from observed traffic to decide where to forward replies. If the switch believes there’s an active session associated with Terri’s IP, it may route responses toward the attacker’s port, effectively hijacking or intercepting the session. That’s why the aim is to trick the switch into thinking Terri’s computer is involved in a live session on the attacker’s side.

The other options describe different ideas not aligned with this technique: enabling a tunneling feature isn’t what this spoofed-ACK method seeks to do; switches can handle and forward ACKs, so a DoS rationale based on “switches cannot send ACKs” is incorrect; and MAC table poisoning by flooding with ACKs describes a MAC flooding approach, not the session-hijacking angle produced by a spoofed ACK indicating an existing session.