Examkin

Question

Difficulty: HardCommon Network Attack Types and Vectors

During a security audit of a dual-stack enterprise LAN, network administrators discover that several IPv4-configured workstations are unexpectedly redirecting web traffic to an untrusted external IP address. Packet captures reveal that these workstations regularly receive unsolicited ICMPv6 Router Advertisement (RA) packets from a non-gateway host. These RA frames specify an unknown link-local IPv6 address as the default gateway and assign a rogue IPv6 DNS server. Which of the following statements accurately describe this network attack and its operational impact? (Select TWO.)

  1. The attacker is exploiting IPv6 Router Advertisements to conduct an On-Path (Man-in-the-Middle) attack via SLAAC spoofing.Answer
  2. Dual-stack client operating systems naturally prefer IPv6 DNS resolution over IPv4, causing traffic to route through the rogue IPv6 gateway.Answer
  3. C
    The incident occurs because MAC address table exhaustion forced the local switch into a fail-open state, broadcasting unicast frames to all switchports.
  4. D
    The compromised state was caused by the attacker altering authoritative AAAA records directly on the enterprise internal DNS server.

Answer

The attack is an On-Path (Man-in-the-Middle) attack executed via rogue ICMPv6 Router Advertisement (RA) / SLAAC spoofing, which leverages the default host OS behavior of prioritizing IPv6 traffic and DNS resolution over IPv4.
In dual-stack network environments, transmitting unauthorized ICMPv6 Router Advertisements (RAs) allows an attacker to automatically configure client network settings via SLAAC. Because modern operating systems default to prioritizing IPv6 connectivity and DNS resolution over IPv4, hosts will send their DNS requests and outbound traffic to the attacker's rogue IPv6 link-local gateway, establishing an On-Path (Man-in-the-Middle) position.

Step-by-Step Solution

1
Analyze the log excerpts and packet capture details.
Identified unsolicited ICMPv6 Router Advertisement (RA) messages originating from an unauthorized internal host.
ICMPv6 RAs are used in Stateless Address Autoconfiguration (SLAAC) to advertise default routers and network parameters to client endpoints.
2
Determine the attack vector and mechanism.
The rogue host announces itself as an IPv6 default gateway and IPv6 DNS provider, placing itself in the communication path (On-Path / MITM).
Workstations accept the unsolicited IPv6 configuration and update their routing and DNS resolution tables.
3
Evaluate operating system traffic preference behavior.
Dual-stack client endpoints prefer IPv6 destination lookup and routing over legacy IPv4 when valid IPv6 parameters are present.
Standard networking stack implementation (RFC 6724) prioritizes IPv6 communications over IPv4 unless explicitly reconfigured.

Key Concept

Rogue IPv6 Router Advertisement (RA) Spoofing and On-Path Attacks
Estimated Time:2m 0s
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic