A network technician notices that several workstations on a local subnet are experiencing intermittent network connectivity issues. Upon checking the IP configurations of affected client devices, the technician discovers unexpected network settings. Which TWO of the following indicators specifically point to the presence of an active rogue DHCP server on the network?
- Workstations are receiving IP addresses and default gateway assignments from an unrecognized address pool.Cevap
- BNetwork security logs show a sudden burst of unsolicited Address Resolution Protocol (ARP) reply packets mapping different IP addresses to the same MAC address.
- Clients report receiving DNS server address assignments pointing to an external or untrusted IP address during lease renewal.Cevap
- DApplying static MAC address filtering on the core switch immediately mitigates the unauthorized IP address assignment issue.
Cevap
The presence of a rogue DHCP server is indicated by workstations receiving IP addresses and gateway settings from an unrecognized address pool, as well as clients receiving untrusted DNS server address assignments during DHCP lease options processing.
A rogue DHCP server operates by listening for client DHCPDISCOVER broadcasts and responding with malicious configuration settings. Key indicators include clients acquiring IP address leases outside the enterprise scope and receiving unauthorized default gateway or DNS server address settings that allow attackers to redirect client traffic.
Adım Adım Çözüm
Anahtar Kavram
Rogue DHCP Server Attack Indicators