I have created a testing scenario in VMWare for a man in the middle attack using DHCP spoofing. It's for a college project.

Windows 8 machine bridged to host adapter Kali linux bridged to host adapter Host connected to router X.X.X.1/24 Using ettercap I'm trying to give a fake DHCP lease, pointing to Kali linux ip address X.X.X.161. However Windows 8 refuses to accept the DHCP offer, even tough it arrives before router's offer (tested with wireshark). Tried: ipconfig /release & ipconfig /renew

I read Windows prefer to select a DHCP offer of a previous accepted gateway address. But I tried to disable/reinstall network card and restart Windows. No change.

What is the criteria for select a DHCP offer when there are more than one? I read everywhere that the one wich arrives first is selected, but it doesn't appears to be the case.

closed as off-topic by Ron Maupin Jun 21 at 0:21

This question appears to be off-topic. The users who voted to close gave this specific reason:

  • "NE is a site for to ask and provide answers about professionally managed networks in a business environment. Your question falls outside the areas our community decided are on topic. Please visit the help center for more details. If you disagree with this closure, please ask on Network Engineering Meta." – Ron Maupin
If this question can be reworded to fit the rules in the help center, please edit the question.

  • Unfortunately, questions about host/server configurations are off-topic here, as are questions about protocols above OSI layer-4. – Ron Maupin Jun 21 at 0:21

I have troubleshooted this in a real scenario.

In Windows 7 with Wifi Intel driver, it just gets the first DHCP offer to arrive.

  • As a general rule, the first answer always wins. – Ricky Beam May 5 '15 at 23:38

Not the answer you're looking for? Browse other questions tagged or ask your own question.