For this to happen, the client must first send a request to the network via broadcast. When using DHCP, a server ensures that individual clients receive their configurations. This can also happen with DHCP, however, there is a solution: The fraudulent use of DHCP can be countered with so-called “DHCP snooping”.

As a result, things can be happening in the background that you never find out about.

When you rely on someone else to do the work for you, you hand over some of your control. If the device leaves the network, the IP address can automatically be reapproved for a new network user.Īt the same time, however, this simplification creates a gateway for criminals. It also reduces the required address space. Because the address assignment process is dynamic, it isn’t possible for two devices to be assigned the same IP address. This not only simplifies working with large networks, it also minimizes sources of error. Individual network users receive their IP addresses, subnet masks and other information via a server. Today, instead of individually setting up every client, every PC, every smartphone and every network-compatible device, we mostly use DHCP. All requests coming from an untrusted port are intercepted by the switch and all replies of untrusted ports are discarded.The Dynamic Host Configuration Protocol (DHCP) makes configuring networks easier. Untrusted ports are not allowed to send messages like DHCP offer.ĭHCP snooping table is used to identify the untrusted or filtered port messages. For the untrusted port, DHCP message request needs to be validated. In DHCP snooping, trusted ports are allowed to send DHCP offers and DHCP ACK messages. To mitigate these attacks DHCP snooping is used. This way the attacker can perform man in middle attack which captures the client's request forward them to the server and receives response from the server and send that to the client.

After performing the starvation attack, the attacker can set a rogue DHCP server and starts serving the victim machine with fake IP addresses. In DHCP starvation attack client sends so many DHCP Discover messages with fake MAC addresses so that the DHCP pool gets filled and Server is not able to serve valid clients. When a client request from DHCP server it create an entry in its DHCP database and assigns the IP address to client.Īn attacker can perform two types of attack: It provides information like IP address, subnet mask, DNS, default gateway and other information. IntroductionĭHCP server provide the information needed by the client to run on the network. Make sure you have permission from the proper individuals before you use any of the tools or techniques described here. *** Nothing contained in this article is intended to teach or encourage the use of security tools or methodologies for illegal or unethical purposes.

Dhcp snooping enterasys