DHCP Considerations
Dynamic Host Configuration Protocol (DHCP) allows hosts to request IP addresses from a central server Additional parameters are usually passed as well, including DNS server IP address and the default gateway.
DHCP can be attacked in two ways:
• Attackers could continue to request IP addresses from a DHCP server by changing their source MA addresses in much the same way as is done in a CAM table flooding attack. A tool to execute such attack is available here: http://packetstormsecurity.org/DoS/DHCP Gobbler.tar.gz. If successful, t attack will cause all the leases on the DHCP server to be allocated.
• The second attack is a bit nastier. Here, the attacker introduces a rogue DHCP server into the network. The server then attempts to offer DHCP addresses to whomever requests them. The fielc for the default gateway and DNS server are set to the attacker's host, enabling all sorts of sniffing and MITM attacks much like dsniff. Even if your real DHCP server is operational, it doesn't mean yo won't get a rogue address. What happens to you depends on the host OS you are running. Here is the relevant bit from the DHCP RFC 2131:
The client collects DHCPOFFER messages over a period of time, selects one DHCPOFFER message from the (possibly many) incoming DHCPOFFER messages (e.g., the first DHCPOFFI message or the DHCPOFFER message from the previously used server) and extracts the serv address from the "server identifier" option in the DHCPOFFER message. The time over which the client collects messages and the mechanism used to select one DHCPOFFER are implementation dependent.
I tested a number of different OSs and all accepted the first DHCP offer they received, whether it was fc their old IP address or not.
The method used to stop the first attack is identical to how you stop the CAM table flooding attack: use port security. The second attack is more difficult to stop. DHCP Authentication (RFC 3183) will help but not yet been implemented (and also has some nasty key management implications). Both DHCP snoopii and specific VACLs can help and are defined in the next sections.
Continue reading here: Dhcp Vacls
Was this article helpful?