3

A DHCP client can send continous DHCPREQUEST requests with a changing MAC address. In a small network it could teoretically cause problems, when a dynamic IP addresses pool is small.

How are computer networks protected against such actions?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 11 '17 at 16:48
3

In a managed Cisco wired solution you commonly find ip dhcp snooping used in combination with ip arp inspection and ip source guard.

Though while googling for the same solution some time ago, I viewed other vendors also providing excellent protection against dhcp starvation attacks, mac address spoofing and cam table overflow attack.

Guess one the answers would be a combination of many factors such as a manageable enterprise access switch, a well patched/configured dhcpd server and a good syslog server that can record what is going on in your network.

| improve this answer | |
  • "security in depth". Snooping will stop someone from pretending to be a dhcp server, but will do little to stop 200 hosts from being on a port. (which is common for stacked/chained switches) – Ricky Beam May 26 '15 at 21:08
  • 'ip dhcp snooping' also supports a packet-based rate limiter, which can help protect against the question's specific attack. – cpt_fink May 27 '15 at 2:57
  • @Ron & cpt_fink. Yes, we should also mention port-security which assists with a secure solution. A link to read for the OP:- cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/… – user4565 May 27 '15 at 19:15
1

Some more sophisticated DHCP solutions will use ping or other activity metrics to gauge actual lease usage, instead of always reserving the address for the entire lease (counting on poorly behaved clients, like you pose). This would allow them to verify and maintain leases still in use and reclaim leases that were issued to a malicious actor. Most (especially basic ones) will simply get to the end of the reservation block and stop answering requests until the leases expire. So, yes a DOS based on lease exhaustion is quite possible on most networks. But, other forms of DOS are more mischievous (such as sucking up all uplink bandwidth, or attacking actual hosts) so most attackers don't bother causing problems for DHCP, and therefore mitigation countermeasures are rarely ever considered.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.