CISCO Cyberops Security Fundamentals Section 01: TCP/IP Protocol Suite (Q 51-60)

In order to send an Ethernet frame to a destination on an Ethernet network, a host must know the MAC address of that destination. The MAC address is a unique identifier assigned to each network interface card (NIC) on the network. It is used to identify the specific device to which the frame needs to be sent. The receiving port number, IP address, and window size are not relevant to sending an Ethernet frame on an Ethernet network.

An ARP (Address Resolution Protocol) request is sent by a host to discover the MAC address belonging to an IP address. ARP is used to map an IP address to a corresponding MAC address on a local network. When a host wants to communicate with another host, it needs to know the MAC address of the destination host. So, it sends an ARP request to the network asking for the MAC address associated with the given IP address.

The MAC address FFFF:FFFF:FFFF is the correct answer because it represents the broadcast address. In Ethernet, the MAC address FFFF:FFFF:FFFF is used to send a frame to all devices on the network. When a host wants to send a broadcast message, it sets the destination MAC address to FFFF:FFFF:FFFF so that it is received by all devices on the network.

In a DHCP transaction, four messages are exchanged. The first message is the DHCPDISCOVER, which is sent by the client to discover available DHCP servers. The second message is the DHCPOFFER, which is sent by the server in response to the DHCPDISCOVER, offering the client an IP address. The third message is the DHCPREQUEST, which is sent by the client to request the offered IP address from a specific server. Finally, the fourth message is the DHCPACK, which is sent by the server to acknowledge the client's request and provide the client with the offered IP address.

DHCP starvation is a common DHCP attack where an attacker exhausts all available IP addresses in a DHCP server's address pool, preventing legitimate devices from obtaining an IP address. Rogue DHCP server is another common attack where an attacker sets up a fake DHCP server on a network, tricking devices into connecting to it and providing sensitive information. Both of these attacks exploit vulnerabilities in the DHCP protocol to disrupt network connectivity and potentially gain unauthorized access to network resources.

The destination port defined in the DHCP Offer message is 68 UDP. DHCP (Dynamic Host Configuration Protocol) uses UDP (User Datagram Protocol) as the transport protocol. Port 68 is the well-known port number assigned to DHCP client/server communication. The DHCP Offer message is sent by the DHCP server to offer configuration parameters (IP address, subnet mask, gateway, etc.) to a DHCP client. Therefore, the correct answer is 68 UDP.

ARP (Address Resolution Protocol) operates between Layer 2 and Layer 3 of the OSI model. This protocol is responsible for mapping an IP address to a physical (MAC) address on a local network. It is used to resolve IP addresses to MAC addresses in order to facilitate communication between devices on the same network. ARP operates at Layer 2 to obtain the MAC address of a device in the same network, and at Layer 3 to determine the IP address of the destination device.

ARP messages are sent using the Ethertype designation 0x0806 in the frame header. Ethertype is a field in the Ethernet frame header that identifies the protocol encapsulated within the frame. In this case, 0x0806 indicates that the frame contains an Address Resolution Protocol (ARP) message. ARP is used to map an IP address to a MAC address on a local network.

The destination port defined in the DHCP Discover message is 67 UDP. This is because DHCP (Dynamic Host Configuration Protocol) uses UDP (User Datagram Protocol) as the transport protocol. The destination port 67 is used by the DHCP server to receive and process the DHCP Discover messages sent by the client.