A DHCP client can send continous DHCPREQUEST requests with a changing MAC address. In a small network it could teoretically cause problems, when a dynamic IP addresses pool is small.

How are computer networks protected against such actions?

  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 11, 2017 at 16:48

2 Answers 2


In a managed Cisco wired solution you commonly find ip dhcp snooping used in combination with ip arp inspection and ip source guard.

Though while googling for the same solution some time ago, I viewed other vendors also providing excellent protection against dhcp starvation attacks, mac address spoofing and cam table overflow attack.

Guess one the answers would be a combination of many factors such as a manageable enterprise access switch, a well patched/configured dhcpd server and a good syslog server that can record what is going on in your network.

  • "security in depth". Snooping will stop someone from pretending to be a dhcp server, but will do little to stop 200 hosts from being on a port. (which is common for stacked/chained switches)
    – Ricky
    May 26, 2015 at 21:08
  • 'ip dhcp snooping' also supports a packet-based rate limiter, which can help protect against the question's specific attack.
    – cpt_fink
    May 27, 2015 at 2:57
  • @Ron & cpt_fink. Yes, we should also mention port-security which assists with a secure solution. A link to read for the OP:- cisco.com/c/en/us/td/docs/switches/lan/catalyst6500/ios/12-2SX/…
    – user4565
    May 27, 2015 at 19:15

Some more sophisticated DHCP solutions will use ping or other activity metrics to gauge actual lease usage, instead of always reserving the address for the entire lease (counting on poorly behaved clients, like you pose). This would allow them to verify and maintain leases still in use and reclaim leases that were issued to a malicious actor. Most (especially basic ones) will simply get to the end of the reservation block and stop answering requests until the leases expire. So, yes a DOS based on lease exhaustion is quite possible on most networks. But, other forms of DOS are more mischievous (such as sucking up all uplink bandwidth, or attacking actual hosts) so most attackers don't bother causing problems for DHCP, and therefore mitigation countermeasures are rarely ever considered.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.