HPE Aruba Networking ClearPass Policy Manager (CPPM) uses device profiling to classify endpoints,
and one of its passive profiling methods involves analyzing DHCP traffic. DHCP fingerprinting is a
technique where ClearPass examines the DHCP packets sent by a client, particularly the DHCP
Discover packet, to identify the device’s operating system or type based on specific attributes.
Option A, "It can determine information such as the endpoint OS from the order of options listed in
Option 55 of a DHCP Discover packet," is correct. DHCP Option 55 (Parameter Request List) is a field
in the DHCP Discover packet where the client specifies the list of DHCP options it requests from the
server. The order and combination of these options are often unique to specific operating systems or
device types (e.g., Windows, Linux, macOS, or IoT devices). ClearPass maintains a database of DHCP
fingerprints and matches the Option 55 data against this database to classify the endpoint.
Option B, "It can respond to a client’s DHCP Discover with different DHCP Offers and then analyze the
responses," is incorrect because ClearPass does not act as a DHCP server or send DHCP Offers. It
passively snoops DHCP traffic rather than actively responding to DHCP requests.
Option C, "It can snoop DHCP traffic to register the clients’ IP addresses," is partially correct in that
ClearPass does snoop DHCP traffic, but the purpose is not just to register IP addresses for HTTP
probing. While ClearPass can use IP addresses for active probing (e.g., HTTP or SNMP), the question
specifically asks about using DHCP to classify, which is done via fingerprinting, not IP registration.
Option D, "It can alter the DHCP Offer to insert itself as a proxy gateway," is incorrect because
ClearPass does not modify DHCP packets or act as a proxy gateway. This is not a function of ClearPass
in the context of DHCP-based profiling.
The HPE Aruba Networking ClearPass Policy Manager 6.11 User Guide states:
"ClearPass can profile devices using DHCP fingerprinting, a passive profiling method. When a device
sends a DHCP Discover packet, ClearPass examines the packet’s attributes, including the order of
options in DHCP Option 55 (Parameter Request List). The combination and order of these options are
often unique to specific operating systems or device types. ClearPass matches these attributes
against its DHCP fingerprint database to classify the device (e.g., identifying a device as a Windows
10 laptop or an Android phone)." (Page 247, DHCP Fingerprinting Section)
Additionally, the ClearPass Device Insight Data Sheet notes:
"DHCP fingerprinting allows ClearPass to passively collect device information without interfering
with network traffic. By analyzing DHCP Option 55, ClearPass can accurately determine the device’s
operating system and type, enabling precise policy enforcement." (Page 3)
:
HPE Aruba Networking ClearPass Policy Manager 6.11 User Guide, DHCP Fingerprinting Section,
Page 247.
ClearPass Device Insight Data Sheet, Page 3.
===========
