DHCP-based attack

As explained in Acing the CCNA Exam: Volume 2 Advanced Networking and Security

DHCP poisoning is an attack in which a rogue DHCP server supplies clients with malicious configuration, especially a false default gateway, to intercept their traffic.

A DHCP poisoning attack uses a rogue DHCP server to provide valid IP leases while naming itself as the client’s default gateway. The attacker can then intercept and potentially alter traffic before relaying it to the legitimate router. section 13.1

The attack depends on these operational conditions:

• Clients commonly accept the first DHCP OFFER, so the rogue server races the legitimate server or benefits from lower latency. section 13.1
• Port Security does not stop the attack because the rogue server can send DHCP messages from one MAC address. section 13.1
• DHCP Snooping blocks server messages arriving on untrusted ports; trust ports facing DHCP servers and leave host-facing ports untrusted. section 13.3

Defensive switch configuration

Enable DHCP Snooping globally and for each VLAN with ip dhcp snooping and ip dhcp snooping vlan vlans. Configure legitimate server-facing interfaces with ip dhcp snooping trust, then verify using show ip dhcp snooping. section 13.3

Figure 13.1 A DHCP poisoning attack. The rogue DHCP server replies to PC1’s DHCP messages, assigning it an IP address and telling it to use the rogue server as its default gateway. The rogue server then intercepts PC1’s communications.

Shows a rogue DHCP server assigning a client an address and itself as the default gateway, enabling traffic interception. section 13.1

How Acing the CCNA Exam: Volume 2 Advanced Networking and Security covers it

How deep it goes

Details rogue leases, OFFER timing, Port Security limits, and DHCP Snooping trust behavior without exploring packet internals.

Examples

Uses a rogue server, a client’s poisoned default gateway, DHCP OFFER races, and Cisco IOS DHCP Snooping commands.

What it assumes

Assumes DHCP, default gateways, LAN topology, and switch ports while distinguishing DHCP client and server messages.

What you can do after

Diagnose DHCP poisoning risk and configure or verify DHCP Snooping protections on Cisco switches.

How it connects

Connects DHCP poisoning with DHCP Snooping, Port Security, DHCP exhaustion attacks, ARP poisoning, and man-in-the-middle attacks.

liveBookmanning.com

Read Acing the CCNA Exam: Volume 2 Advanced Networking and Security on liveBook Get the book at manning.com

Related concepts

• DHCP snoopingaddressed by · DHCP snooping is a network security feature that filters DHCP messages and builds trusted bindings between clients and assigned addresses.
• port securitycontrasts with · Port security is a network-switch control that restricts a switch port to authorized device addresses or connection conditions and defines responses to violations.
• man-in-the-middle attackuses · A man-in-the-middle attack is a network attack in which an adversary intercepts, relays, impersonates, or alters communication between parties.
• DHCP exhaustion attackincludes · A DHCP exhaustion attack is a denial-of-service technique that consumes a DHCP server's address pool so legitimate clients cannot obtain addresses.

This explainer was generated by Manning's knowledge graph from the text of Acing the CCNA Exam: Volume 2 Advanced Networking and Security. The section links point to the parts of the book it draws on.