DHCP attacks: starvation and rogue servers

DHCP assigns IP, gateway and DNS to clients. It is unauthenticated: the client believes the first server that answers.

Two moves

Starvation: the attacker requests all pool addresses with forged MACs, exhausting it. New clients get no IP (DoS) — or the stage is set for the next step.

Rogue DHCP: the attacker answers faster than the real server, handing out its own machine as gateway/DNS. It becomes a man-in-the-middle over the whole network.

dhcpstarve   # exhausts the pool
# then a rogue DHCP server hands out gateway=attacker

Defence

DHCP snooping on switches: only trusted ports may offer DHCP; replies from untrusted ports are dropped. Port security limits MACs per port against starvation.