Examkin

Soru

Zorluk: ZorNetwork and Wireless Attack Indicators

An enterprise security operations team investigates anomalous traffic patterns within a corporate dual-stack subnetwork. Network monitoring alerts indicate that multiple workstations have dynamically updated their default gateway settings to route external traffic through an unapproved link-local address. Packet captures reveal continuous, unsolicited ICMPv6 Type 134 messages being broadcast across the segment with a high router preference flag enabled. Which of the following attack types is indicated by these findings?

  1. Rogue IPv6 Router Advertisement (RA) attackCevap
  2. B
    Address Resolution Protocol (ARP) poisoning attack
  3. C
    Domain Name System (DNS) amplification attack
  4. D
    Virtual Local Area Network (VLAN) hopping attack

Cevap

Rogue IPv6 Router Advertisement (RA) attack
The scenario describes unsolicited ICMPv6 Type 134 messages (Router Advertisements) with high preference flags, which alter host routing tables on dual-stack subnetworks to direct traffic to an attacker's rogue gateway. This is the classic signature of a Rogue IPv6 Router Advertisement attack.

Adım Adım Çözüm

1
Analyze protocol indicators in the packet capture.
Identified ICMPv6 Type 134 messages, which correspond specifically to IPv6 Router Advertisement (RA) packets used in Neighbor Discovery Protocol (NDP).
Router Advertisements inform local network hosts of default gateway IP addresses and subnetwork prefixes.
2
Evaluate the behavior and impact described in the scenario.
Unsolicited high-preference ICMPv6 Type 134 broadcasts forced dual-stack endpoints to reconfigure their default IPv6 routing table towards an unauthorized link-local address.
This behavior indicates an attacker deploying a rogue IPv6 router to perform an on-path traffic interception attack.
3
Differentiate from alternative network attacks.
Confirmed that IPv4 ARP poisoning, DNS amplification, and 802.1Q VLAN hopping operate on distinct mechanisms and protocols.
Only a Rogue IPv6 Router Advertisement attack produces ICMPv6 Type 134 flooding and spontaneous gateway reconfiguration on IPv6 endpoints.

Anahtar Kavram

IPv6 Neighbor Discovery Protocol (NDP) Vulnerabilities and Rogue Router Advertisements
Bu soruyu puanla

Konular

Network and Wireless Attack Indicators

Bu konudan daha fazla soru