Open cardosec

Case 0543F3 · Network · L2 Practitioner

Two MACs Claim the Gateway

Practise as: Incident drill

Live alertarpwatch on the guest-lounge VLAN reports 10.50.0.1 flipping between the router MAC and an unknown Intel MAC; users report certificate warnings.

  1. 01 What happened?
  2. 02 What is the impact?
  3. 03 What do you do?
Practise this card
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Gateway IP bound to two MACs plus cert warnings indicates ARP spoofing MITM with TLS interception attempts
  2. Locate the attacker via the switch MAC address table (show mac address-table) and shut that port
  3. Assume credentials entered past warnings are exposed; notify users and reset affected accounts
  4. Enable DHCP snooping and Dynamic ARP Inspection on the VLAN; enforce client isolation on guest Wi-Fi
  5. Confirm guest VLAN cannot reach corporate segments; check firewall logs for pivot attempts

Go deeper

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.