Network+ N10-009 · AP Networking · Detect & Analyze

ARP Cache Poisoning: Detect It in a Capture

You are the on-call network analyst for Larkspur Mutual Credit Union. Overnight, monitoring at the Cedar Hollow branch flagged a burst of unsolicited Layer 2 replies on the staff VLAN (VLAN 12), and a teller workstation reported connections dropping for a few seconds at a time. A mirror port, br0-mon, feeds traffic to your analysis station. Capture the branch traffic, isolate the ARP exchanges, and decide whether the gateway is being impersonated.

N10-009:4.2 attacks N10-009:4.3 hardening N10-009:5.5 tools APNET:2.2 ARP APNET:4.5 threats APNET:4.5 indicators
PacketScope iface: br0-mon
idle 0 packets
No. Time Source Destination Protocol Length Info
No packets captured yet. Choose “Start capture”.

Frame detail

Select a packet to inspect its fields.

Lab tasks

  1. Run a capture on br0-mon until it completes (~5 s).
  2. Apply the arp display filter to isolate ARP traffic.
  3. Inspect both ARP replies that bind 10.40.12.1 to a MAC.
  4. Flag the duplicate-binding conflict.

Analysis questions

Score 0 / 9

Your callsign is a pseudonym. This lab collects no real name, email, or ID.

Original simulation for CompTIA Network+ (N10-009) and the College Board AP Networking pilot. “PacketScope” is fictional analyzer chrome, not a commercial product. © 2026 <AUTHOR / ORG NAME>. All rights reserved.