In the last lectures we have discussed attacks on DHCP which are Discover Flooding Attack, DHCP
Starvation and Roque
DHCP Server. Let’s see what countermeasures are available to mitigate the impact.
Let's start with the starvation attack.
It can be mitigated by configuring different security features on the lans switch, access point or wireless
LAN controller.If the hacker sends DHCP Discover packets with different spoofed MAC addresses,
the attack can be mitigated by configuring port security on the switch.
This will limit the number of MAC addresses behind each port and when a violation occurs the admin can
choose to drop the traffic or automatically disable the switch port.
We had an entire lecture on port security when we discussed Mac flooding.
Please watch that video again if you feel the need to recap
what port security is or how it works. To prevent DHCP starvation attack that uses the DHCP
requests encapsulated with the same source MAC address,
the hacker sends all dhcp requests with the same MAC address, you can enable MAC address check
on the DCP server. The DHCP server compares the client's hardware address or chaddr field of received DHCP requests
with the source MAC address in the frame header. If they are the same, the DHCP
server verifies this request as legal and processes it. If they are not the same, the server discards
the DHCP request. Rogue DHCP servers can be mitigated by DHCP snooping. When configuring DHCP
Snooping on the access switch, all ports in the VLAN will be “Untrusted” for DHCP replies. DHCP
Snooping acts like a firewall between untrusted hosts and DHCP servers. You use the DHCP snooping to differentiate
between untrusted interfaces connected to the user and trusted interfaces connected to the DHCP server
or another switch. When an attacker sends a packet like the DHCP offer that normally comes from the DHCP
server on an untrusted port that packet will be dropped and the message will be loged.
In this example I'll show you how to configure the DHCP Snooping on a Cisco Catalyst Switch. We consider
that the legitimate the DHCP server is connected to port Ethernet 0/0 and the no other
the DHCO server is allowed on the network. OK.
So in global configuration mode I am enabling DHCP snooping: ip dhcp snooping
then I'll specify on which VLANs it will operate: ip dhcp snooping vlan 1, 10 and 20.
It's just an example! I'm entering the interface mode, the trusted interface,
ethernet0/0 and I set the interface as being trust.
That means that a DHCP server is allowed to connect to this port.
If you want to see the configuration you execute
sh ip shcp sn. In this example a DHCP server is allowed only on ethernet
0/0 port.
Note that there are also tools called DHCP rogue detectors which can be installed on your host and try
to find any rogue server on the network.
This solution is partial, local and it's not proactive.