A DHCP client can send continous DHCPREQUEST requests with a changing MAC address. In a small network it could teoretically cause problems, when a dynamic IP addresses pool is small.
How are computer networks protected against such actions?
A DHCP client can send continous DHCPREQUEST requests with a changing MAC address. In a small network it could teoretically cause problems, when a dynamic IP addresses pool is small.
How are computer networks protected against such actions?
In a managed Cisco wired solution you commonly find ip dhcp snooping used in combination with ip arp inspection and ip source guard.
Though while googling for the same solution some time ago, I viewed other vendors also providing excellent protection against dhcp starvation attacks, mac address spoofing and cam table overflow attack.
Guess one the answers would be a combination of many factors such as a manageable enterprise access switch, a well patched/configured dhcpd server and a good syslog server that can record what is going on in your network.
Some more sophisticated DHCP solutions will use ping or other activity metrics to gauge actual lease usage, instead of always reserving the address for the entire lease (counting on poorly behaved clients, like you pose). This would allow them to verify and maintain leases still in use and reclaim leases that were issued to a malicious actor. Most (especially basic ones) will simply get to the end of the reservation block and stop answering requests until the leases expire. So, yes a DOS based on lease exhaustion is quite possible on most networks. But, other forms of DOS are more mischievous (such as sucking up all uplink bandwidth, or attacking actual hosts) so most attackers don't bother causing problems for DHCP, and therefore mitigation countermeasures are rarely ever considered.