During an incident investigation on an enterprise dual-stack subnet, a network administrator observes that workstations are directing outbound traffic to an unauthorized device on the local segment. Packet captures indicate that while Dynamic ARP Inspection (DAI) and DHCP Snooping are active and successfully blocking rogue IPv4 gateway announcements, client dual-stack nodes have automatically updated their default gateway settings to a link-local IPv6 address transmitted via unsolicited ICMPv6 Type 134 messages from an unknown host. Which of the following attack vectors is occurring, and what is the primary Layer 2 mitigation required to block it?
- Rogue IPv6 Router Advertisement (RA) spoofing; mitigate by enabling IPv6 RA Guard on access switchports.Cevap
- BARP cache poisoning via Gratuitous ARP injection; mitigate by configuring 802.1Q VLAN trunk isolation.
- CDNS cache poisoning via forged AAAA record responses; mitigate by enforcing DNSSEC validation on internal resolvers.
- DDHCPv6 starvation attack using targeted UDP port 547 flooding; mitigate by enabling Port Security limits on edge ports.
Cevap
Rogue IPv6 Router Advertisement (RA) spoofing; mitigate by enabling IPv6 RA Guard on access switchports.
In dual-stack network environments, hosts automatically configure IPv6 default gateways upon receiving ICMPv6 Type 134 Router Advertisement (RA) messages. Attackers exploit this behavior by broadcasting rogue RAs, directing client traffic through the attacker's system. Because traditional IPv4 security measures such as Dynamic ARP Inspection (DAI) do not process ICMPv6 frames, network switches must run IPv6 RA Guard to inspect and drop unauthorized RA frames on non-router switchports.
Adım Adım Çözüm
Anahtar Kavram
Rogue IPv6 Router Advertisement Spoofing and RA Guard