Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A security operations analyst is evaluating several network monitoring alerts and packet captures from an enterprise environment. Match each observed technical indicator on the left with its corresponding attack classification on the right.

  • High volume of 802.11 management frames containing frame subtype 0x000C causing widespread client dropsDisassociation Attack
  • Unsolicited ICMPv6 Type 134 packets broadcast across a segment overriding client default gatewaysRogue IPv6 Router Advertisement
  • Ethernet frames containing dual 802.1Q headers transmitted over a native trunk port to reach an isolated segmentDouble Tagging VLAN Hopping
  • Unsolicited vCard contact details pushed to employee mobile devices via short-range RF connectionsBluejacking

Answer

The technical indicators match their corresponding attack classifications as follows: 802.11 subtype 0x000C frames map to Disassociation Attack; ICMPv6 Type 134 packets map to Rogue IPv6 Router Advertisement; dual 802.1Q headers map to Double Tagging VLAN Hopping; and unsolicited Bluetooth vCards map to Bluejacking.
Each indicator corresponds to a distinct network or wireless attack mechanism: 802.11 disassociation frames (0x000C) break active Wi-Fi sessions; ICMPv6 Type 134 packets distribute rogue default gateway details; dual 802.1Q VLAN headers enable switch trunk hopping; and unsolicited Bluetooth vCards represent Bluejacking.

Step-by-Step Solution

1
Analyze the 802.11 wireless frame indicator
Identify frame subtype 0x000C as an 802.11 disassociation frame.
Spoofed disassociation frames force wireless clients to disconnect from their legitimate access point.
2
Analyze the IPv6 ICMP message type
Identify ICMPv6 Type 134 as a Router Advertisement message.
Unauthorized RA packets alter IPv6 neighbor discovery and divert traffic through a rogue gateway.
3
Analyze the Layer 2 frame header structure
Identify dual 802.1Q VLAN encapsulation tags as double tagging.
Switches processing native VLAN traffic strip the outer header, allowing the inner VLAN tag to bypass switch port isolation.
4
Analyze the mobile short-range wireless activity
Identify unsolicited Bluetooth vCard transfers as Bluejacking.
Bluejacking uses OBEX protocol to send uninvited messages to Bluetooth targets without exfiltrating data.

Key Concept

Distinguishing technical indicators of Layer 2 switch attacks, wireless denial-of-service, and network auto-configuration spoofing.
Rate this question