In analyzing a DHCP-related interception, which observation would suggest a DHCP-based man-in-the-middle attack?

In analyzing a DHCP-related interception, which observation would suggest a DHCP-based man-in-the-middle attack?

• A. IP spoofing
• B. Two DHCP ACK packets indicate MITM
• C. ARP poisoning
• D. DNS tunneling

Answer: (B)

In DHCP-based interception, the client expects a single, clean handshake: after the client broadcasts a request for an IP, one DHCP server should respond with an ACK granting that lease. If you observe two DHCP ACK packets in response to the same request, it signals that more than one DHCP server is replying—one legitimate and one rogue. That second ACK means a second server is attempting to finalize a lease, which is a hallmark of a man-in-the-middle setup where an attacker tries to coerce the client into accepting an alternate network configuration, potentially redirecting traffic or altering DNS and gateway settings. Other observations like IP spoofing, ARP poisoning, or DNS tunneling involve different layers or attack goals. IP spoofing and ARP poisoning are common MITM techniques but don’t specifically reflect the DHCP handshake anomalies. DNS tunneling concerns data exfiltration over DNS and isn’t a direct indicator of a DHCP-level interception. The presence of two DHCP ACKs, however, directly points to conflicting responses in the DHCP process, which is a strong sign of a DHCP-based man-in-the-middle.

In DHCP-based interception, the client expects a single, clean handshake: after the client broadcasts a request for an IP, one DHCP server should respond with an ACK granting that lease. If you observe two DHCP ACK packets in response to the same request, it signals that more than one DHCP server is replying—one legitimate and one rogue. That second ACK means a second server is attempting to finalize a lease, which is a hallmark of a man-in-the-middle setup where an attacker tries to coerce the client into accepting an alternate network configuration, potentially redirecting traffic or altering DNS and gateway settings.

Other observations like IP spoofing, ARP poisoning, or DNS tunneling involve different layers or attack goals. IP spoofing and ARP poisoning are common MITM techniques but don’t specifically reflect the DHCP handshake anomalies. DNS tunneling concerns data exfiltration over DNS and isn’t a direct indicator of a DHCP-level interception. The presence of two DHCP ACKs, however, directly points to conflicting responses in the DHCP process, which is a strong sign of a DHCP-based man-in-the-middle.