312-50 Question 188
Single answer▪ Sniffing Technique: DHCP AttacksDuring an internal assessment, you connect to a flat Layer 2 office network and notice several user workstations suddenly receive IP addresses from an unexpected private range, along with a different default gateway and DNS server than the organization normally uses. Users report intermittent connectivity and some web sessions appear to be passing through an unknown host. Which attack most likely explains this behavior?
- A
A rogue DHCP server attack that is handing out unauthorized lease information to clients
- B
An ARP poisoning attack that changes DHCP lease duration and forces clients to renew
- C
A DNS cache poisoning attack on the internal resolver that alters client IP addressing
- D
A VLAN hopping attack that injects DHCPDISCOVER frames into another broadcast domain
Show answer and explanation
Correct answer: A
Explanation
The best answer is the rogue DHCP server attack. In DHCP-based attacks, an attacker places an unauthorized DHCP server on the local broadcast domain and responds to client requests with malicious network configuration before the legitimate server does. By supplying a false default gateway and DNS server, the attacker can redirect victim traffic for sniffing, interception, or further manipulation. This is a classic DHCP-based man-in-the-middle setup often discussed in CEH objectives under sniffing and network attacks.
From a defensive perspective, standard best practices include enabling DHCP snooping on managed switches, defining trusted switch ports for legitimate DHCP servers, and using related protections such as Dynamic ARP Inspection where appropriate. Vendor guidance from major switch manufacturers and enterprise network hardening documentation commonly recommend DHCP snooping specifically to mitigate rogue DHCP servers. In a real assessment, verifying the source MAC address of DHCPOFFER/DHCPACK messages with a packet capture and checking switch port mappings would help confirm the attack.
- A. Correct.
Correct. In a rogue DHCP server attack, an unauthorized system responds to DHCPDISCOVER or DHCPREQUEST messages faster than the legitimate DHCP server and supplies attacker-controlled network settings such as IP address, subnet mask, default gateway, and DNS server. This can redirect traffic through an attacker-controlled host and enable sniffing or man-in-the-middle activity. The scenario specifically mentions clients receiving addresses from an unexpected range and different gateway/DNS values, which strongly indicates rogue DHCP behavior.
- B. Incorrect.
Incorrect. ARP poisoning manipulates Layer 2 to Layer 3 address resolution by associating the attacker's MAC address with another host's IP address, typically the gateway. It does not modify DHCP lease parameters or assign clients new IP ranges, gateways, or DNS servers through the DHCP process. Someone might choose this option because ARP poisoning is also used for man-in-the-middle attacks, but it does not explain the unauthorized DHCP lease information in the scenario.
- C. Incorrect.
Incorrect. DNS cache poisoning can cause users to resolve hostnames to malicious or incorrect IP addresses, but it does not assign clients new IP addresses, default gateways, or subnet masks. The scenario involves DHCP configuration values being changed at lease assignment time, which is outside the scope of DNS cache poisoning. This is a plausible distractor because malicious DNS settings are mentioned, but DNS poisoning alone cannot account for the full set of symptoms.
- D. Incorrect.
Incorrect. VLAN hopping is a technique for gaining access to traffic in another VLAN, often through switch spoofing or double tagging under specific misconfigurations. While an attacker in another VLAN could potentially reach services they should not, VLAN hopping itself does not directly explain clients receiving unauthorized DHCP leases on their local segment. The core issue described is an unauthorized DHCP responder on the broadcast domain.