Examkin

Question

Difficulty: MediumNetwork and Wireless Attack Indicators

A network security analyst investigating connectivity issues on a corporate subnet captures traffic from an interface receiving anomalous activity. Packet inspection reveals thousands of broadcast DHCPDISCOVER requests sent within a 10-second window, each specifying a unique, randomized client hardware MAC address. As a result, legitimate clients on the network are receiving IP address APIPA configurations due to scope exhaustion. Which of the following attack indicators is described in this scenario?

  1. DHCP starvationAnswer
  2. B
    Rogue DHCP server
  3. C
    ARP cache poisoning
  4. D
    MAC flooding

Answer

The attack indicator described in the scenario is DHCP starvation.
The correct answer identifies DHCP starvation. In a DHCP starvation attack, an attacker broadcasts a large volume of DHCPDISCOVER frames using randomized MAC addresses. The DHCP server responds by leasing out available IP addresses until the entire address pool scope is depleted. Consequently, legitimate workstations requesting an IP address fail to receive one and fall back to Automatic Private IP Addressing (APIPA).

Step-by-Step Solution

1
Analyze the observed network traffic pattern.
The capture shows rapid broadcast of DHCPDISCOVER frames containing unique, randomized client hardware MAC addresses.
Identifying the protocol and specific message type helps isolate the resource being targeted.
2
Evaluate the operational impact on client endpoints.
Legitimate devices fail to receive IP leases from the server pool and default to APIPA addresses (169.254.x.x169.254.x.x).
Exhaustion of all available pool addresses is the direct outcome of spoofed requests occupying leases.
3
Correlate protocol patterns and impacts with security attack classifications.
Generating spoofed MAC requests to consume all DHCP pool leases defines a DHCP starvation attack.
Distinguishing DHCP starvation from Rogue DHCP or MAC flooding relies on identifying whether the target is the DHCP IP lease pool or Layer 2 switch CAM tables.

Key Concept

DHCP Starvation Attack Indicators
Estimated Time:1m 15s
Rate this question

Topics

Network and Wireless Attack Indicators

More questions from this topic