What is DHCP starvation, and why is it usually paired with a rogue DHCP server?
Show the answer
Say this first
The attacker sends a flood of DHCPDISCOVERs, each with a different client hardware address, until the real server's pool is empty. Legitimate clients then get no lease. With the real server unable to answer, the attacker serves new clients from its own DHCP server and gives itself out as the default gateway or DNS server, which turns a denial of service into a man in the middle. DHCP snooping blocks the rogue server's offers on untrusted ports, and its rate limit and MAC check, together with port security, stop the starvation.
Go deeper
Which control stops which variant
| Attack variant | Control that stops it |
|---|---|
| New source MAC for every request | port security maximum |
| One source MAC, random client hardware address inside DHCP | snooping verify mac-address (on by default) |
| High request rate from one port | ip dhcp snooping limit rate, port err-disables |
| Rogue server answering on an access port | snooping trust boundary drops the OFFER and ACK |
Detection
- Pool utilization jumps to 100 percent in minutes. Alert on pool usage, not only on outages.
- The DHCP server shows hundreds of new leases with random-looking MACs from one relay or circuit ID.
- On the switch, the snooping rate limit err-disables the port and logs it, for example
%PM-4-ERR_DISABLE: dhcp-rate-limit error detected on Gi1/0/7, putting Gi1/0/7 in err-disable state.
For IPv6
Rogue Router Advertisements and DHCPv6 servers do the same job, and RA Guard and DHCPv6 Guard are the matching controls.
They will ask next
How do you find a rogue DHCP server quickly?
On an affected client,
ipconfig /allshows the DHCP server address. Resolve it to a MAC witharp -a, thenshow mac address-table address <mac>on the switches leads to the port.Does a rogue server need starvation to work?
No. It only needs to answer faster than the real server, and a local rogue usually beats a server reached through a relay. Starvation just guarantees it wins.
Traps
- Assuming port security alone stops starvation. Tools that vary only the address inside DHCP pass it.