Examkin

Question

Difficulty: Very hardCommon Network Attack Types and Vectors

During an incident investigation on an enterprise dual-stack subnet, a network administrator observes that workstations are directing outbound traffic to an unauthorized device on the local segment. Packet captures indicate that while Dynamic ARP Inspection (DAI) and DHCP Snooping are active and successfully blocking rogue IPv4 gateway announcements, client dual-stack nodes have automatically updated their default gateway settings to a link-local IPv6 address transmitted via unsolicited ICMPv6 Type 134 messages from an unknown host. Which of the following attack vectors is occurring, and what is the primary Layer 2 mitigation required to block it?

  1. Rogue IPv6 Router Advertisement (RA) spoofing; mitigate by enabling IPv6 RA Guard on access switchports.Answer
  2. B
    ARP cache poisoning via Gratuitous ARP injection; mitigate by configuring 802.1Q VLAN trunk isolation.
  3. C
    DNS cache poisoning via forged AAAA record responses; mitigate by enforcing DNSSEC validation on internal resolvers.
  4. D
    DHCPv6 starvation attack using targeted UDP port 547 flooding; mitigate by enabling Port Security limits on edge ports.

Answer

Rogue IPv6 Router Advertisement (RA) spoofing; mitigate by enabling IPv6 RA Guard on access switchports.
In dual-stack network environments, hosts automatically configure IPv6 default gateways upon receiving ICMPv6 Type 134 Router Advertisement (RA) messages. Attackers exploit this behavior by broadcasting rogue RAs, directing client traffic through the attacker's system. Because traditional IPv4 security measures such as Dynamic ARP Inspection (DAI) do not process ICMPv6 frames, network switches must run IPv6 RA Guard to inspect and drop unauthorized RA frames on non-router switchports.

Step-by-Step Solution

1
Analyze protocol telemetry and message types
Identified ICMPv6 Type 134 (Router Advertisement) messages as the source of unauthorized default gateway manipulation.
ICMPv6 Type 134 is specifically used by IPv6 routers in Neighbor Discovery Protocol (NDP) to announce prefix information and default gateway availability to client nodes.
2
Evaluate existing security controls and protocol scope
Confirmed that Dynamic ARP Inspection (DAI) and DHCP Snooping only safeguard IPv4 ARP and DHCPv4 transactions.
Dual-stack hosts often prefer IPv6 by default. If IPv6 control traffic is unsecured, attackers can bypass IPv4 security mechanisms by acting as an IPv6 default router.
3
Determine the precise attack type and Layer 2 countermeasure
Diagnosed Rogue IPv6 Router Advertisement spoofing and identified IPv6 RA Guard as the mandatory switchport mitigation.
RA Guard operates at Layer 2 to inspect ICMPv6 Router Advertisement messages and drop unauthorized RAs on user-facing switchports before they reach client machines.

Key Concept

Rogue IPv6 Router Advertisement Spoofing and RA Guard
Rate this question

Topics

Common Network Attack Types and Vectors

More questions from this topic