Which of the following actions should the administrator take next?

An administrator believes that a system on VLAN 12 is Address Resolution Protocol (ARP) poisoning clients on the network. The administrator attaches a system to VLAN 12 and uses Wireshark to capture traffic. After reviewing the capture file, the administrator finds no evidence of ARP poisoning.

Which of the following actions should the administrator take next?
A . Clear the ARP cache on their system.
B . Enable port mirroring on the switch.
C . Filter Wireshark to only show ARP traffic.
D . Configure the network adapter to promiscuous mode.

Answer: D

Explanation:

Reference: https://www.tutorialspoint.com/ethical_hacking/ethical_hacking_arp_poisoning.htm