A technician is troubleshooting a host that is having intermittent issues connecting to internal network resources and the company servers. Using a packet sniffer, the technician notices there are several TCP communications that are missing packets in sequence and need to be retransmitted. The technician receives several
SYN-ACK packets with incorrect addressing. Which of the following is the MOST likely cause of these issues?
The issue described involves intermittent connectivity problems, missing TCP packets in sequence, and incorrect addressing in SYN-ACK packets, suggesting a problem at the local network level. A misconfigured VLAN on the local switch can easily lead to these symptoms by causing packets to be routed to incorrect destinations, leading to retransmissions and connectivity issues. DNS poisoning and ARP poisoning attacks typically result in different symptoms, such as being directed to malicious websites or machines rather than causing packet sequence issues. An evil twin attack would generally affect Wi-Fi users rather than causing the specific problems described.
the host is receiving SYN-ACK packets with incorrect addressing. This is more indicative of a routing issue, such as a misconfigured VLAN, rather than an ARP poisoning attack. ARP poisoning would not typically cause TCP communications to miss packets in sequence and need to be retransmitted, nor would it cause SYN-ACK packets to be sent to incorrect addresses.
Can someone provide info on why this is the right answer? This sounds like a TCP SYN Flood, not sure it is ARP Poisoning. The other 3 attacks also I don't think relate to this, could it be D?