- by x32x01 ||
DHCP is responsible for automatically assigning IP addresses and other network settings to devices. But what happens when an attacker connects a rogue DHCP server to your network?
An attacker can exploit DHCP to distribute malicious network configurations, redirect user traffic, or exhaust the available IP address pool.
Two important attacks to understand are DHCP Starvation and DHCP Spoofing.
Let's explore how these attacks work, how they can be combined, and how DHCP Snooping helps protect your network.
Normally, when a device joins a network, it requests an IP address through a process known as DORA:
The goal is to consume the available IP address pool.
Once the pool is exhausted, legitimate devices may be unable to obtain an IP address from the authorized DHCP server.
Important: DHCP Starvation does not automatically disable the legitimate DHCP server or give the attacker exclusive control over DHCP. It primarily creates an availability problem that can help facilitate another attack.
Unlike a legitimate DHCP server, the rogue server may provide malicious settings, including:
A possible attack scenario looks like this:
The resulting traffic path may look like this:
Client → Attacker (Fake Gateway) → Legitimate Router → Internet
This can create a Man-in-the-Middle (MITM) position, allowing the attacker to intercept or manipulate traffic passing through the malicious gateway.
However, this requires the attacker to successfully receive and forward the traffic. DHCP Spoofing alone does not guarantee visibility into encrypted application data.
It is commonly available on managed switches and works by inspecting DHCP messages and distinguishing between trusted and untrusted switch ports.
The basic idea is simple:
Only authorized DHCP servers should be allowed to send DHCP server responses to clients.
DHCP Snooping achieves this by classifying switch interfaces into two categories.
By default, DHCP Snooping-enabled interfaces are generally treated as untrusted unless explicitly configured otherwise.
Legitimate DHCP Server → Switch → Client Devices
The switch port connected to the authorized DHCP server, or the appropriate uplink toward it, should be configured as trusted.
Ports connected to end-user devices should remain untrusted.
When a client sends a DHCP Discover message, the switch can forward that request toward the legitimate DHCP server.
However, if an attacker connects a rogue DHCP server to an untrusted port and attempts to send DHCP Offer or ACK messages, DHCP Snooping blocks those unauthorized server responses.
Important: DHCP Snooping does not simply block all DHCP Discover packets from user ports. Legitimate clients must still be able to request IP addresses.
The protection focuses on preventing unauthorized DHCP server responses and validating DHCP traffic according to the switch's security rules.
Assume the following network setup:
Step 1: Enable DHCP Snooping Globally
This enables the DHCP Snooping feature on the switch.
Step 2: Enable DHCP Snooping for VLAN 10
DHCP Snooping must be enabled for the VLANs you want to protect.
Step 3: Configure the Trusted Port
This interface is the authorized path toward the legitimate DHCP server.
DHCP server responses received through this trusted interface are permitted.
Only configure interfaces as trusted when they genuinely lead toward authorized DHCP infrastructure.
Step 4: Configure DHCP Rate Limiting
DHCP Snooping can also limit the rate of DHCP packets received on an interface.
For example:
This example configures a limit of 10 DHCP packets per second on the interface.
If the configured threshold is exceeded, supported Cisco platforms may place the interface into an error-disabled state.
This helps reduce the risk of DHCP packet flooding and certain DHCP Starvation attempts.
The appropriate rate limit depends on the network environment, switch platform, and number of legitimate DHCP clients connected to the interface.
Avoid applying an unnecessarily low limit to ports serving multiple devices.
Step 5: Verify the Configuration
Use the following command to inspect the DHCP Snooping configuration:
To inspect the DHCP Snooping binding database, use:
The binding database can contain information such as client MAC addresses, assigned IP addresses, VLANs, lease times, and interfaces.
These bindings can also support additional security features, including Dynamic ARP Inspection and IP Source Guard.
Note that command availability and behavior may vary between Cisco platforms and software versions.
An attacker may combine both techniques, but DHCP Spoofing does not require DHCP Starvation to succeed.
Watch out for these common mistakes:
Starvation attempts to exhaust available IP addresses, while Spoofing attempts to distribute unauthorized network configurations.
When combined, these attacks can disrupt connectivity and potentially redirect client traffic through an attacker-controlled gateway.
DHCP Snooping is one of the most important switch-level defenses against rogue DHCP servers.
By configuring trusted interfaces correctly, keeping client-facing ports untrusted, and applying appropriate DHCP rate limits, network administrators can significantly reduce the risks associated with these attacks.
For stronger protection, DHCP Snooping should be combined with additional network security controls rather than treated as a complete defense against every DHCP-related attack.
An attacker can exploit DHCP to distribute malicious network configurations, redirect user traffic, or exhaust the available IP address pool.
Two important attacks to understand are DHCP Starvation and DHCP Spoofing.
Let's explore how these attacks work, how they can be combined, and how DHCP Snooping helps protect your network.
1. What Is a DHCP Starvation Attack?
A DHCP Starvation attack attempts to exhaust the available IP addresses on a legitimate DHCP server.Normally, when a device joins a network, it requests an IP address through a process known as DORA:
- Discover: The client searches for an available DHCP server.
- Offer: The DHCP server offers an available IP address.
- Request: The client requests the offered address.
- Acknowledgment (ACK): The server confirms the IP address lease.
The goal is to consume the available IP address pool.
Once the pool is exhausted, legitimate devices may be unable to obtain an IP address from the authorized DHCP server.
Important: DHCP Starvation does not automatically disable the legitimate DHCP server or give the attacker exclusive control over DHCP. It primarily creates an availability problem that can help facilitate another attack.
2. What Is a DHCP Spoofing Attack?
DHCP Spoofing occurs when an unauthorized DHCP server, commonly called a Rogue DHCP Server, responds to clients with network configuration information.Unlike a legitimate DHCP server, the rogue server may provide malicious settings, including:
- An attacker-controlled default gateway.
- A malicious DNS server.
- Incorrect IP configuration.
- Network settings designed to redirect traffic.
How DHCP Spoofing Can Lead to a Man-in-the-Middle Attack
Consider a network containing a legitimate DHCP server, a router, several client devices, and an attacker.A possible attack scenario looks like this:
- The attacker connects an unauthorized device to the local network.
- The attacker attempts to exhaust the legitimate DHCP server's address pool.
- The attacker introduces a rogue DHCP server.
- A client broadcasts a DHCP Discover message.
- The rogue server responds with an IP configuration containing the attacker's IP address as the default gateway.
- If the client accepts this configuration, its traffic intended for other networks may be sent through the attacker's device.
The resulting traffic path may look like this:
Client → Attacker (Fake Gateway) → Legitimate Router → Internet
This can create a Man-in-the-Middle (MITM) position, allowing the attacker to intercept or manipulate traffic passing through the malicious gateway.
However, this requires the attacker to successfully receive and forward the traffic. DHCP Spoofing alone does not guarantee visibility into encrypted application data.
3. What Is DHCP Snooping?
DHCP Snooping is a Layer 2 security feature that helps prevent unauthorized DHCP servers from distributing IP configuration information to network clients.It is commonly available on managed switches and works by inspecting DHCP messages and distinguishing between trusted and untrusted switch ports.
The basic idea is simple:
Only authorized DHCP servers should be allowed to send DHCP server responses to clients.
DHCP Snooping achieves this by classifying switch interfaces into two categories.
| Port Type | Description |
|---|---|
| Trusted Port | Allows DHCP server responses from authorized sources |
| Untrusted Port | Restricts DHCP server messages originating from unauthorized devices |
Trusted vs. Untrusted Ports
Imagine the following network:Legitimate DHCP Server → Switch → Client Devices
The switch port connected to the authorized DHCP server, or the appropriate uplink toward it, should be configured as trusted.
Ports connected to end-user devices should remain untrusted.
When a client sends a DHCP Discover message, the switch can forward that request toward the legitimate DHCP server.
However, if an attacker connects a rogue DHCP server to an untrusted port and attempts to send DHCP Offer or ACK messages, DHCP Snooping blocks those unauthorized server responses.
Important: DHCP Snooping does not simply block all DHCP Discover packets from user ports. Legitimate clients must still be able to request IP addresses.
The protection focuses on preventing unauthorized DHCP server responses and validating DHCP traffic according to the switch's security rules.
4. How to Configure DHCP Snooping on a Cisco Switch
Let's look at a basic Cisco IOS configuration example.Assume the following network setup:
- VLAN 10 contains the client devices.
- GigabitEthernet0/1 is the uplink toward the legitimate DHCP server.
- GigabitEthernet0/2 is connected to an end-user device.
Step 1: Enable DHCP Snooping Globally
Bash:
Switch(config)# ip dhcp snoopingStep 2: Enable DHCP Snooping for VLAN 10
Bash:
Switch(config)# ip dhcp snooping vlan 10Step 3: Configure the Trusted Port
Bash:
Switch(config)# interface GigabitEthernet0/1
Switch(config-if)# ip dhcp snooping trustDHCP server responses received through this trusted interface are permitted.
Only configure interfaces as trusted when they genuinely lead toward authorized DHCP infrastructure.
Step 4: Configure DHCP Rate Limiting
DHCP Snooping can also limit the rate of DHCP packets received on an interface.
For example:
Bash:
Switch(config)# interface GigabitEthernet0/2
Switch(config-if)# ip dhcp snooping limit rate 10If the configured threshold is exceeded, supported Cisco platforms may place the interface into an error-disabled state.
This helps reduce the risk of DHCP packet flooding and certain DHCP Starvation attempts.
The appropriate rate limit depends on the network environment, switch platform, and number of legitimate DHCP clients connected to the interface.
Avoid applying an unnecessarily low limit to ports serving multiple devices.
Step 5: Verify the Configuration
Use the following command to inspect the DHCP Snooping configuration:
Bash:
Switch# show ip dhcp snooping Bash:
Switch# show ip dhcp snooping bindingThese bindings can also support additional security features, including Dynamic ARP Inspection and IP Source Guard.
Note that command availability and behavior may vary between Cisco platforms and software versions.
5. DHCP Spoofing vs. DHCP Starvation
Although these attacks are related, they have different objectives.| Feature | DHCP Starvation | DHCP Spoofing |
|---|---|---|
| Main objective | Exhaust available DHCP addresses | Distribute unauthorized DHCP configurations |
| Common technique | Flooding DHCP requests | Introducing a rogue DHCP server |
| Primary impact | Legitimate clients may fail to obtain IP addresses | Clients may receive malicious network settings |
| Potential consequence | Denial of Service (DoS) | Traffic redirection or MITM |
| Defensive measure | DHCP rate limiting and additional access controls | DHCP Snooping with properly configured trusted ports |
6. Common DHCP Snooping Configuration Mistakes
Even when DHCP Snooping is enabled, incorrect configuration can cause security issues or disrupt legitimate network connectivity.Watch out for these common mistakes:
- Trusting user-facing ports: This may allow an unauthorized DHCP server to distribute network settings.
- Forgetting to enable DHCP Snooping on the correct VLAN: Global configuration alone may not provide the intended protection.
- Applying overly restrictive rate limits: Legitimate DHCP traffic may trigger an interface shutdown.
- Forgetting DHCP relay and uplink requirements: DHCP traffic must still be able to reach the authorized server.
- Ignoring DHCP Option 82 compatibility: Some DHCP environments require additional configuration to handle relay-agent information correctly.
7. Final Thoughts
DHCP Starvation and DHCP Spoofing target different weaknesses in the DHCP process.Starvation attempts to exhaust available IP addresses, while Spoofing attempts to distribute unauthorized network configurations.
When combined, these attacks can disrupt connectivity and potentially redirect client traffic through an attacker-controlled gateway.
DHCP Snooping is one of the most important switch-level defenses against rogue DHCP servers.
By configuring trusted interfaces correctly, keeping client-facing ports untrusted, and applying appropriate DHCP rate limits, network administrators can significantly reduce the risks associated with these attacks.
For stronger protection, DHCP Snooping should be combined with additional network security controls rather than treated as a complete defense against every DHCP-related attack.