A rogue DHCP reply would return information that designates the hacker's machine as the Default gateway or DNS server. I don't understand please explain EDIT: DHCP MITM cannot be used to act as a DNS server. I found nothing on google that said otherwise. The correct answer is "Only ii} is Correct". https://techdifferences.com/difference-between-dns-and-dhcp.html; EDIT: No, you didn't search or think hard enough, both are correct (but thanks for linking to the basics). The attacker's machine can indeed act as DNS server from initializing the attack as a rogue DHCP server; a (rogue) DHCP server can instruct the interface what IP to use for DNS requests, in this case the attacker's. Then, the attacker's machine, now a rogue DNS server as well, can forward traffic to cloned websites. This is a legitimate, well-known attack that's been around for a long time, explained here among many more possibilities and I'd advise to give all of it a thorough read if failing to understand - https://seclists.org/vuln-dev/2002/Sep/99