After several support calls complaining about network issues you capture the following series of packets:

06:02:50.626330 arp reply 192.168.99.35 is-at 0:80:c8:f8:4a:51 (0:80:c8:f8:4a:51)
06:02:51.622727 arp reply 192.168.99.35 is-at 0:80:c8:f8:4a:51 (0:80:c8:f8:4a:51)
06:02:52.620954 arp reply 192.168.99.35 is-at 0:80:c8:f8:4a:51 (0:80:c8:f8:4a:51)
What type of attack is occurring?

A. man-in-the-middle
B. VLAN hopping
C. SYN flood
D. smurf

A
Explanation: The packets displayed are gratuitous arp replies. These are created by the hacker and are replies to a question that never came from the devices in the network. It causes the devices to update their arp cache with the mappings included in the packet. This creates incorrect mappings in the devices arp cache, and when done correctly can cause the hacker to receive all traffic between two machines, or make him the man-in-the-middle in a man-in-the-middle attack.