Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A network engineer is investigating security alerts after several host systems on an enterprise subnet unexpectedly autoconfigured IPv6 address interfaces and began routing outbound network traffic through an unknown link-local address. Which of the following technical indicators directly confirm that a Rogue IPv6 Router Advertisement (RA) attack is taking place? (Select TWO).

  1. Unsolicited ICMPv6 Type 134 (Router Advertisement) frames broadcast on the local link specifying an unauthorized default gateway.Answer
  2. Host interfaces automatically generating IPv6 global unicast addresses via Stateless Address Autoconfiguration (SLAAC) using an untrusted prefix.Answer
  3. C
    A high volume of ICMPv6 Type 135 (Neighbor Solicitation) requests originating from an external public IP address targeting internal workstations.
  4. D
    Frequent duplicate MAC address alerts recorded on switch access ports resulting from a MAC table flooding attempt.

Answer

The correct indicators are unsolicited ICMPv6 Type 134 (Router Advertisement) frames broadcast on the local link specifying an unauthorized default gateway, and host interfaces automatically generating IPv6 global unicast addresses via Stateless Address Autoconfiguration (SLAAC) using an untrusted prefix.
In a Rogue IPv6 Router Advertisement attack, the malicious actor transmits unsolicited ICMPv6 Type 134 Router Advertisement packets over the local subnet. Endpoints configured for Stateless Address Autoconfiguration (SLAAC) accept these packets, derive new IPv6 addresses using the advertised prefix, and direct external IPv6 traffic to the attacker's machine acting as the rogue default gateway.

Step-by-Step Solution

1
Identify the protocol and control message types associated with IPv6 dynamic routing and autoconfiguration.
Router Advertisements use ICMPv6 Type 134 packets sent by routers to inform hosts of available network prefixes and default gateway locations.
Understanding ICMPv6 packet types is necessary to isolate neighbor discovery traffic from rogue routing signals.
2
Analyze how target endpoints react to receiving untrusted ICMPv6 Type 134 packets.
Hosts operating with SLAAC enabled process the advertised prefix, create a corresponding IPv6 address, and adjust their local routing table to forward IPv6 traffic to the rogue gateway.
This behavior confirms the mechanics of an IPv6 Man-in-the-Middle (MitM) positioning attack via rogue RA.

Key Concept

Rogue IPv6 Router Advertisement (RA) Attack Indicators
Estimated Time:1m 30s
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic