Which action is described as NDP ARP poisoning?

• A. Spoofing bogus address in the NA response
• B. Spoofing non-existent addresses in NS requests
• C. Spoofing address in the NS request
• D. Spoofing a Router Advertisement (RA) to redirect traffic

Answer: (A)

In IPv6, neighbor discovery uses Neighbor Solicitation and Neighbor Advertisement to map IP addresses to link-layer (MAC) addresses. Poisoning occurs when an attacker injects a crafted Neighbor Advertisement that falsely binds an IPv6 address to the attacker's MAC address. By sending a bogus NA, the attacker corrupts the neighbor cache of other devices, causing traffic destined for that IPv6 address to be sent to the attacker instead. This direct tampering with the address-to-MAC mapping is why spoofing a bogus address in the NA response is the correct description of NDP poisoning.

Other ND actions describe different threats. Spoofing an NS request or its source address doesn't directly poison a host's binding cache the way an NA does. Spoofing a Router Advertisement is a separate ND attack aimed at steering traffic through a rogue router rather than corrupting a specific address-to-MAC mapping.