Disrupting network configuration and redirecting traffic by abusing DHCP
Introduction
Dynamic Host Configuration Protocol (DHCP) automatically provides network configuration to clients. When a device connects to a network, it normally does not know which IP address, default gateway or DNS server it should use – DHCP provides this information automatically.
DHCP attacks exploit the trust that network devices place in DHCP. Because DHCP automatically provides devices with network configuration data, an attacker who can manipulate DHCP traffic may be able to disrupt network access or redirect a victim’s traffic.
Two important DHCP attacks to understand are DHCP Starvation and DHCP Spoofing.
Although they work differently, they can also be used together. An attacker can first exhaust the legitimate DHCP server’s available addresses and then introduce a rogue DHCP server that provides malicious configuration to clients.
DHCP Starvation
DHCP Starvation is a denial-of-service attack that attempts to consume all available IP addresses in a DHCP scope.
In this attack, the attacker generates a large number of DHCP requests, often using many different or spoofed MAC addresses.
The DHCP server believes these are different clients and begins allocating addresses to them.
Eventually, the available address pool can become exhausted, thus leaving none available fot legitimate clients
Example
Consider a DHCP scope containing the following IP range – 192.168.1.100 – 192.168.1.200
This provides approximately 101 addresses.
An attacker generates hundreds or thousands of apparent DHCP clients.
The server begins allocating addresses:
- AA:AA:AA:01 → 192.168.1.100
- AA:AA:AA:02 → 192.168.1.101
- AA:AA:AA:03 → 192.168.1.102
- AA:AA:AA:04 → 192.168.1.103
Eventually the entire scope is consumed
A legitimate employee then connects to the network and requests an address.
The DHCP server has nothing available to provide, as such the legitimate user is denied the ability to connect to the network.
One popular tool for conducting such an attack as this is DHCPig
DHCP Spoofing
DHCP Spoofing occurs when an attacker introduces a rogue DHCP server onto the network.
Instead of allowing the legitimate DHCP server to provide configuration, the attacker attempts to respond to DHCP requests with malicious or incorrect information.
A rogue DHCP server could potentially provide:
- A malicious default gateway
- A malicious DNS server
- Incorrect network configuration
- Incorrect routes
- Other attacker-controlled configuration
The objective is often to redirect or intercept network traffic.
DHCP Starvation + DHCP Spoofing
These two attacks can become significantly more dangerous when combined.
The attacker can first attempt to exhaust the legitimate DHCP server’s address pool. Once legitimate clients can no longer obtain addresses normally, the attacker introduces a rogue DHCP server.
This is why DHCP attacks should not simply be viewed as isolated network disruptions. They can potentially become part of a larger man-in-the-middle or traffic-redirection attack.
What can an attacker change?
A rogue DHCP server can potentially provide a client with malicious configuration.
For example:
| DHCP Setting | Legitimate | Rogue |
|---|---|---|
| IP Address | 192.168.1.125 | 192.168.1.125 |
| Subnet Mask | 255.255.255.0 | 255.255.255.0 |
| Default Gateway | 192.168.1.1 | Attacker-controlled gateway |
| DNS Server | 192.168.1.10 | Attacker-controlled DNS |
| Network Configuration | Legitimate | Malicious |
The IP address itself may appear completely normal – The danger can instead be hidden inside the gateway or DNS configuration.
DHCP Starvation vs DHCP Spoofing
| Aspect | DHCP Starvation | DHCP Spoofing |
|---|---|---|
| Primary objective | Exhaust DHCP addresses | Provide malicious configuration |
| Attack type | Denial of Service | Traffic manipulation / redirection |
| Main target | DHCP address pool | DHCP clients |
| Technique | Large numbers of DHCP requests | Rogue DHCP server |
| Immediate effect | Clients cannot obtain addresses | Clients receive incorrect configuration |
| Potential impact | Network disruption | Traffic interception or redirection |
| Can be combined? | Yes | Yes |
| Key defence | DHCP Snooping / rate limiting | DHCP Snooping / trusted ports |
The two attacks therefore have different objectives.
- DHCP Starvation attacks availability.
- DHCP Spoofing attacks trust.
Detecting DHCP abuse
DHCP attacks can produce several useful indicators.
DHCP Starvation indicators
Look for:
- Large numbers of DHCP Discover messages
- Unusually high DHCP traffic
- Rapid allocation of addresses
- Large numbers of previously unseen MAC addresses
- DHCP scope approaching exhaustion
- Legitimate clients repeatedly failing to obtain addresses
- Multiple leases associated with unusual client identities
DHCP Spoofing indicators
Look for:
- Multiple DHCP servers responding on the same network
- Unexpected DHCP Offers
- Clients receiving different gateways
- Unexpected DNS server addresses
- Sudden gateway changes
- DHCP traffic appearing on unexpected switch ports
- Network traffic being redirected through an unknown device
A particularly useful indicator is the appearance of a DHCP server that should not exist.
DHCP Snooping
Whilst the name might suggest another attack against DHCP it is not. DHCP Snooping is one of the most important switch-level protections against DHCP attacks.
The switch distinguishes between:
TRUSTED PORT -> LEGITIMATE DHCP SERVER
and
UNTRUSTED PORT -> CLIENT DEVICE
Any DHCP server responses arriving through an untrusted port can then be blocked. This prevents an ordinary endpoint from behaving like an authorised DHCP server.
Prevention
Organisations should use multiple layers of protection against DHCP abuse
- DHCP Snooping – Configure switches to allow DHCP server traffic only through authorised ports.
- Rate Limiting – Limit the number of DHCP requests that can originate from a single access port. This can help reduce DHCP Starvation attacks.
- Port Security – Restrict the number of MAC addresses permitted on access ports. This makes large-scale MAC address manipulation more difficult.
- IP Source Guard – Use DHCP Snooping information to help prevent clients from using unauthorised IP addresses.
- Network Monitoring – Monitor DHCP traffic and alert on things like unknown DHCP servers, abnormally high request rates, unexpected DHCP Offers, rapid address allocation, and configuration changes
- Network Segmentation – Separate sensitive systems and infrastructure from ordinary user access networks.
The goal is not simply to protect the DHCP server itself.
The goal is to ensure that only authorised infrastructure is allowed to influence client network configuration.
Conclusion
DHCP attacks exploit something that most users never think about: the trust placed in automatic network configuration.
- DHCP Starvation attempts to exhaust the available address pool, preventing legitimate devices from joining or communicating on the network.
- DHCP Spoofing introduces a rogue DHCP server that attempts to provide malicious network configuration to clients.
The two attacks can also be combined, allowing an attacker to move from network disruption to traffic manipulation.
Switch-level protections such as DHCP Snooping, trusted ports, Port Security and IP Source Guard, combined with effective monitoring, can significantly reduce the risk posed by DHCP attacks.