DHCP Starvation Attacks: How They Work and How to Stop Them

DHCP is fundamental to modern networking, automatically assigning IP addresses to devices. But this convenience comes with vulnerabilities, particularly the DHCP starvation attack - a serious threat to network availability.

What is a DHCP Starvation Attack?

A DHCP starvation attack is a malicious digital attack that targets DHCP servers by flooding them with bogus DISCOVER packets until the server exhausts its supply of IP addresses. This creates a denial-of-service (DoS) condition where legitimate devices can't get on the network.

The Attack Mechanism

The attack follows this pattern:

1. Flooding Phase: The attacker sends hundreds of DHCP DISCOVER packets with spoofed MAC addresses.
2. Exhaustion Phase: The DHCP server responds to each request, reserving IP addresses from its pool.
3. Service Denial: With no addresses left, legitimate clients are denied service.

Attackers often combine this with a rogue DHCP server to enable man-in-the-middle attacks.

Real-World Impact

When successful, these attacks can:

• Knock out network connectivity for legit users
• Cause router CPU to go to 100%
• Enable secondary attacks like credential harvesting

Prevention Strategies

Here are some countermeasures:

1. DHCP Snooping: A feature that differentiates between trusted and untrusted DHCP messages. It keeps a binding table of legit IP-MAC address pairs.
2. Port Security: Limits the number of MAC addresses per switch port, prevents MAC address flooding.
3. Rate Limiting: Limits the number of DHCP packets processed in a timeframe.
4. IP Address Pool Management: Increasing the DHCP pool size makes exhaustion harder, but this isn't a complete solution.
5. MAC Address Verification: Ensures the source MAC in frame headers matches the DHCP request.

Example: Implementing Protection on MikroTik

For MikroTik routers:

• Enable DHCP snooping features
• Configure trusted ports for legit DHCP servers
• Set MAC address limits per port

Key Terms

DORA: DHCP process flow (Discover, Offer, Request, Acknowledgement) MITM (Man-in-the-Middle): Attacker intercepts and potentially alters communication Rogue DHCP Server: Attacker sets up a DHCP server to provide malicious network config MAC Spoofing: Changing a device’s MAC to impersonate other devices or hide identity DHCP Snooping: Feature that filters and validates DHCP messages

Regularly audit and monitor DHCP server logs for unusual activity also recommended to detect early.