A laptop on a retail user VLAN answers DHCP discovers from other clients and offers its own address as the default gateway. Which problem is present?
Select an answer to reveal the explanation.
Short Explanation
Somebody set up a second front desk and started handing out directions, and the directions lead back to their own counter. You have a laptop answering DHCP discovers and naming itself as the gateway, which is a rogue DHCP server. A fake radio, a forged ARP, or a relay that only forwards the discover does not write that offer.
Full Explanation
A rogue DHCP server is an unauthorized device that answers client discovers and offers leases. On this retail VLAN the laptop does that, and the offer names the laptop as the default gateway. Clients that accept it send off-subnet traffic to the laptop. A rogue access point is an unauthorized radio. It can impersonate the store's name, and the stem is a laptop answering discovers on the user VLAN, not a radio. ARP poisoning can also make the laptop look like the gateway, by binding the gateway IP to the laptop MAC. That lie is an ARP reply, and this capture of the problem is a DHCP offer. A relay forwards a discover toward a real server and stamps the gateway interface. It does not originate an offer that names itself as the clients' gateway. Exam caveat: the first offer a client accepts wins, so a faster rogue can beat a healthy server. DHCP snooping trusts offers only on uplink ports. Operational check: find the MAC in the rogue offers, shut that switch port, and confirm new clients receive the real gateway.