A security operations analyst is evaluating several network monitoring alerts and packet captures from an enterprise environment. Match each observed technical indicator on the left with its corresponding attack classification on the right.
- High volume of 802.11 management frames containing frame subtype 0x000C causing widespread client dropsDisassociation Attack
- Unsolicited ICMPv6 Type 134 packets broadcast across a segment overriding client default gatewaysRogue IPv6 Router Advertisement
- Ethernet frames containing dual 802.1Q headers transmitted over a native trunk port to reach an isolated segmentDouble Tagging VLAN Hopping
- Unsolicited vCard contact details pushed to employee mobile devices via short-range RF connectionsBluejacking
Answer
The technical indicators match their corresponding attack classifications as follows: 802.11 subtype 0x000C frames map to Disassociation Attack; ICMPv6 Type 134 packets map to Rogue IPv6 Router Advertisement; dual 802.1Q headers map to Double Tagging VLAN Hopping; and unsolicited Bluetooth vCards map to Bluejacking.
Each indicator corresponds to a distinct network or wireless attack mechanism: 802.11 disassociation frames (0x000C) break active Wi-Fi sessions; ICMPv6 Type 134 packets distribute rogue default gateway details; dual 802.1Q VLAN headers enable switch trunk hopping; and unsolicited Bluetooth vCards represent Bluejacking.
Step-by-Step Solution
Key Concept
Distinguishing technical indicators of Layer 2 switch attacks, wireless denial-of-service, and network auto-configuration spoofing.