Examkin

Question

Difficulty: MediumUtilizing Hardware Testers and Packet Analyzers

A network administrator suspects that an unauthorized device acting as a rogue DHCP server is responding to client requests on a local subnet and handing out invalid default gateway addresses. The administrator connects a laptop running a packet analyzer to a mirrored port on the switch. Which display filter should the administrator apply in the packet analyzer to isolate traffic originating specifically from DHCP servers?

  1. udp.srcport == 67Answer
  2. B
    tcp.port == 67
  3. C
    udp.dstport == 53
  4. D
    ip.proto == 67

Answer

The display filter udp.srcport == 67 correctly isolates outbound DHCP server traffic, allowing the administrator to identify the IP and MAC address of the rogue server.
DHCP communication utilizes UDP ports 67 and 68. The server listens on port 67 and sends outbound response messages (DHCP Offer and DHCP ACK) using UDP source port 67. Applying a display filter for udp.srcport == 67 isolates packets generated by any DHCP server on the broadcast domain, revealing the source MAC and IP addresses of the unauthorized rogue device.

Step-by-Step Solution

1
Identify the protocol and port usage for DHCP communication.
DHCP relies on UDP transport, where servers listen on port 67 and clients send requests from port 68.
Understanding transport protocol port assignments is required to write packet filters.
2
Determine the direction of traffic required to identify the rogue server.
Server responses (DHCP Offer and DHCP ACK) originate from the server using source port 67.
Filtering by source port 67 isolates packets sent BY the server rather than requests sent BY clients.
3
Select the exact filter expression matching UDP source port 67.
The expression udp.srcport == 67 captures all server outbound DHCP traffic.
This isolates rogue server responses containing the offending gateway configurations.

Key Concept

Packet Analyzer Display Filters for DHCP Troubleshooting
Rate this question

Topics

Utilizing Hardware Testers and Packet Analyzers

More questions from this topic