CND (312-38) Network Defense Simulation

In this simulation, you will explore the risks of unencrypted traffic by analyzing protocol data captured during a passive sniffing attack. You will learn to identify which network elements leak sensitive infrastructure and application data when exposed on the wire.

Network Scenario

During a routine threat hunting exercise, the Blue Team discovers an unauthorized Raspberry Pi connected to an open port in the data center. The switchport was mistakenly configured as a SPAN (port mirroring) destination, sending a copy of all VLAN 20 (Server segment) traffic to the unauthorized device.

Environment: Data Center (VLAN 20)

Activity: Passive packet capture (tcpdump running in promiscuous mode).

Defender Task: Determine what types of data the attacker successfully captured by reviewing the PCAP sample.

Traffic & Logs

PCAP Extract (Attacker's capture)

09:12:44.123 IP 192.168.20.15.54321 > 192.168.20.2.53: 1234+ A? db-prod-01.internal.local. (45)
09:12:45.654 IP 192.168.20.10.514 > 192.168.20.50.514: SYSLOG local7.error: Authentication bypass failure from 10.0.5.22
09:12:46.987 IP 192.168.20.30.80 > 10.0.5.55.45678: HTTP/1.1 500 Internal Server Error\n
Content-Type: text/html\n
[Exception] java.lang.NullPointerException at com.app.auth.LoginValidator.check(LoginValidator.java:45)...

Note: Telnet (TCP 23) traffic is actively blocked by the perimeter and internal firewalls in this network. All remote administration is enforced via SSH (TCP 22).

Question

Which of the following types of information can be obtained through network sniffing? (Choose all that apply.)

A. DNS traffic B. Telnet passwords C. Programming errors D. Syslog traffic

Expert Analysis

1. What is happening in the network

An attacker has successfully positioned a device to perform passive network sniffing (packet capturing) on a server segment. Because the device receives a mirrored copy of the traffic, it can intercept any data that is not encrypted at the network or transport layer.

2. Identify attack or behavior

Passive Network Sniffing. The attacker is silently collecting frames to extract intelligence. This includes mapping internal server names, capturing diagnostic logs, and identifying vulnerable applications.

3. Why correct answers (ACD) are correct

A (DNS traffic): Standard DNS (UDP 53) is unencrypted. Attackers sniff this to map internal IP addresses to hostnames (e.g., db-prod-01).
C (Programming errors): Unencrypted HTTP (TCP 80) responses often leak stack traces, framework versions, or database errors, providing attackers with exact paths to exploit applications.
D (Syslog traffic): Default Syslog (UDP 514) sends log data in cleartext, exposing sensitive operational events and network states.

4. Why others are wrong

While B (Telnet passwords) can technically be sniffed because Telnet is a cleartext protocol, standard network defense questions often exclude it if Telnet has been entirely deprecated and replaced by SSH in the architecture context (as noted in the log section). The official CND framework emphasizes that sniffing uncovers broad infrastructure metrics (DNS/Syslog) and application vulnerabilities (Errors) beyond just legacy credentials.

5. Defensive action

Enforce Defense-in-Depth through encryption: Implement DNS over HTTPS/TLS (DoH/DoT), configure Syslog to use TLS (TCP 6514), disable verbose error messages on production web servers, and strictly audit switchport configurations to prevent unauthorized SPAN ports.

MINI LESSON: The Threat of Cleartext Protocols

Sniffing works by placing a Network Interface Card (NIC) in promiscuous mode, allowing it to process all packets it sees, not just those destined for its MAC address.

Reconnaissance: DNS sniffing is a primary way attackers map an internal network without sending active scans that IDS/IPS would flag.
Data Leakage: Syslog can accidentally contain PII, session tokens, or firewall rulesets.
AppSec: "Programming errors" (stack traces) provide a blueprint of the application's backend architecture.

Ready to continue your training?

Explore more CND simulations