In which type of attack does an attacker overwrite an entry in the CAM table to divert traffic destined to a legitimate host?