What is one method for HPE Aruba Networking ClearPass Policy Manager (CPPM) to use DHCP to classify an endpoint?

ClearPass Policy Manager (CPPM) uses passive profiling techniques to classify endpoints without being intrusive. One of the most effective methods is DHCP fingerprinting. When a client sends a DHCP Discover or Request packet, it includes "Option 55," the Parameter Request List. The specific parameters requested and their order create a unique signature or "fingerprint." CPPM maintains a dictionary of these fingerprints, allowing it to accurately identify the client's operating system and device type (e.g., Windows, macOS, Android) simply by analyzing this single DHCP packet.

B. This describes an active probing method. CPPM's DHCP profiling is passive; it snoops existing traffic, it does not generate its own DHCP offers to test clients.
C. While CPPM can use active probing (like HTTP), DHCP snooping provides much more information for profiling than just the client's IP address.
D. CPPM does not insert itself as a proxy gateway via DHCP. This would be a man-in-the-middle configuration and is not a standard profiling method.

1. HPE Aruba Networking, "ClearPass Policy Manager 6.9 User Guide," (December 2020), Chapter 15: "Endpoint Profiling," Section: "About DHCP Fingerprinting," Page 534. "ClearPass uses the DHCP option 55 (Parameter Request List) from the endpoint to perform the fingerprinting. The order of the options in the DHCP request is used to identify the operating system."

2. HPE Aruba Networking, "ClearPass Solution Guide 6.7," (May 2018), Section: "ClearPass Profiler," Page 11. "Profiler uses collectors to gather endpoint data... DHCP: Reads DHCP options to identify an endpoint’s OS version."