If an attacker compromised a host on a site's internal network and wanted to trick other machines into using that host as the default gateway, which…

DHCP (Dynamic Host Configuration Protocol) is used to automatically assign network configurations to clients, including an IP address, subnet mask, DNS server, and default gateway. In a DHCP spoofing attack, an attacker introduces a rogue DHCP server onto the network. This rogue server responds to DHCP discovery requests from clients, often faster than the legitimate server. The rogue server's response (DHCP Offer) provides the victim client with valid IP information but sets the default gateway address to the IP of the attacker's compromised machine. Consequently, the victim's outbound traffic is routed through the attacker's machine, enabling a man-in-the-middle attack.

A. MAC Flooding: Overwhelms a switch's CAM table, causing it to broadcast traffic, but does not change a host's configured default gateway.

B. CDP Manipulation: Affects Cisco device discovery and can be used for reconnaissance, but does not alter the default gateway settings on end-hosts.

C. Telnet Attack: A general term for attacking the Telnet service, not a specific method for redirecting network traffic by altering gateway settings.

E. VLAN Hopping: An attack to gain access to different VLANs, not to change the default gateway for hosts within the same VLAN.

---

1. CERT Coordination Center (Carnegie Mellon University). (2002). Vulnerability Note VU#222130: Man-in-the-Middle Attacks Using Rogue DHCP Servers. CERT/CC. Retrieved from https://www.kb.cert.org/vuls/id/222130.

Reference Detail: The "Description" section states

"A rogue DHCP server can provide a default gateway

DNS server

or other configurable parameters that will cause clients to send traffic to a location of the attacker's choosing."

2. Cisco Systems

Inc. (2023). IP Addressing: DHCP Configuration Guide

Cisco IOS XE Gibraltar 16.12.x.

Reference Detail: In the chapter "Configuring DHCP Snooping

" the "Information About DHCP Snooping" section describes the threat from rogue DHCP servers: "An attacker can set up a rogue DHCP server and reply to DHCP requests with bogus IP address and default gateway information."

3. Z. Li

G. Yan

and J. Wu. (2019). "DHCP-Shield: A Comprehensive DHCP Security Assessment and Protection Framework." IEEE Access

vol. 7

pp. 133318-133332. DOI: 10.1109/ACCESS.2019.2941491.

Reference Detail: Section II.A

"DHCP Spoofing Attack

" explains that an attacker can deploy a rogue DHCP server to "assign a malicious default gateway to the victim client

thus launching a man-in-the-middle (MITM) attack."