DHCP attacks and mitigation methods

How DHCP spoofing and starvation attacks work and how DHCP snooping with trusted ports, rate limiting, and a binding database mitigates them.

DHCP spoofing

DHCP spoofing occurs when an attacker attempts to respond to DHCP requests and tries to list itself (spoofs) as the default gateway or DNS server, hence initiating a man in the middle attack.

DHCP Starvation

A DHCP starvation attack works by broadcasting DHCP requests with spoofed MAC addresses.

DHCP snooping

These DHCP attacks can be mitigated by configuring DHCP Snooping which enables specific ports only to pass DHCP traffic. All other ports will be untrusted and can only send DHCP requests. If a DHCP offer is detected in an untrusted port, it will be shut down.

Optionally, first, because some DHCP servers do not like option 82, we disable option 82 insertion from global configuration:

SW1(config)#no ip dhcp snooping information option

DHCP snooping enabled per VLAN, with the uplinks marked trusted so the rogue server on an untrusted access port cannot answer requests

When we apply ip dhcp snooping vlan X then all interfaces on VLAN X become untrusted.

If you want the switch to remember the DHCP snooping binding database across the reboots, you should configure DHCP snooping database agent:

SW1(config)#ip dhcp snooping database flash:snoop.txt

To mitigate DHCP Starvation, we can limit the packet per second rate by the command below:

SW1(config-if)#ip dhcp snooping limit rate ?
  <1-2048>  DHCP snooping rate limit

It looks simple, but how DHCP snooping achieves this is not so simple.

DHCP Snooping Binding Database

consists of:

• DHCP Client MAC address
• The VLAN client resides in
• The leased IP address of the client
• The interface where the client is connected

SW1#show ip dhcp snooping

To show the leases from our legitimate DHCP server. Very important and necessary information:

SW1#show ip dhcp snooping binding

SW1#show ip dhcp snooping binding

SW1#debug ip dhcp snooping packet