During an internal engagement, you are positioned on a flat /24 network segment that carries traffic between a group of workstations and a legacy internal web application that authenticates over HTTP. You want to intercept credentials that users submit to this application without deploying a rogue access point or disrupting the entire segment. Which technique will most effectively allow you to capture the plaintext credentials in transit?