0

I was reading this page, when I came across this warning:

WARNING!: DHCP reservations generally rely on a MAC address to reserve a particular IP address assignment. If you randomize your MAC address you will break your reservation.

Suppose that we have a DHCP server to allocate IP addresses on a network. Imagine that we intentionally connect a rogue device that is set to continuously spoof its MAC address and then reconnect to the network (requesting a new IP to the DHCP). As I understand it, the DHCP will reserve an IP for every MAC address, therefore if this process is done fast enough, the DHCP would run out of IP addresses, preventing new legitimate devices to connect until the lease time expires.

While this seems theoretically possible, I am not sure if it would work in practice.

  • Can MAC spoofing make DHCP run out of IP addresses?

  • Is there a name for such attack?

  • Are there any defense mechanisms to prevent this kind of attack?

  • 2
    It would be a DOS attack. Countermeasures include for example level 2 filters and/or authentication. – Seth Sep 14 '17 at 11:47
  • 1
    there are two kinds of "reservations", those based on lease (temporary), and those based on administratively configured rules (permanent). For lease-based reservations, the server will stop responding to new DHCP requests when its pool of addresses is exhausted, but will free up space as soon as a lease expires. You cannot run out of these reservations without also running out of addresses, which is probably the bigger concern. For permanent reservations, they are not automatically created, so an admin would have to enter more associations than the server supports. – Frank Thomas Sep 14 '17 at 11:55
1

Yes, a rogue device on your Ethernet or Wi-Fi LAN could take up all your DHCP leases and even use ARP to make all IP addresses on the network (even ones outside of the DHCP pool) seem occupied. That's just the tip of the iceberg. Bad guys can do all kinds of stuff to cause problems for LAN owners and fellow users.

The premise of an Ethernet or Wi-Fi LAN is that it is a safe place. Only trusted devices should be allowed to connect. Trying to run a LAN without that premise is fraught with problems as soon as a semi knowledgeable, semi malicious user (or piece of malware) shows up. Require 802.1X authentication on your LAN and only let trusted people/devices connect.

If you have to allow unauthenticated / untrustworthy devices, but want to limit the damage rogues can cause, don't allow them onto a shared LAN. Automatically quarantine unauthenticated devices each onto their own single-device VLAN and impose careful egress filtering on each such VLAN so they can't cause problems for others. Could be more trouble than it's worth, but there are probably enterprise class products that make it easy.

0

You are misreading the warning. The term address reservation is a way to allocate the same, fixed IP address every time a device requests a connection from the DHCP server.

This is based on recognising the MAC address and allocating the predefined address from its table. All the warning is saying is that if you spoof a different MAC address, the DHCP server will not see your actual address, so it cannot make the match to the entry in its table and you will get a random address from the pool.

You are confusing address reservation with address allocation. In the latter case the address is unavailable to other connecting devices until the device with the allocated address disconnects, when the address is released to the DHCP pool and becomes available again for other devices.

There is a time-out applied (the lease time) before an allocated address is released, so that temporary network problems do not result in constantly-changing IP addresses.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.