DHCP exhaustion attack

As explained in Acing the CCNA Exam: Volume 2 Advanced Networking and Security

A DHCP exhaustion attack is a denial-of-service technique that consumes a DHCP server's address pool so legitimate clients cannot obtain addresses.

A DHCP exhaustion attack, also called DHCP starvation, is a denial-of-service technique that prevents legitimate clients from receiving IP addresses. The attacker sends countless DHCP DISCOVER messages while spoofing the source MAC address in each request, consuming the DHCP server’s address pool. section 11.2.1 section 11.6

Recognize the attack by its traffic pattern and effect:

• Generates repeated DHCP DISCOVER messages with spoofed MAC addresses. section 11.2.1
• Exhausts the DHCP server’s available address pool. section 11.2.1
• Denies service because legitimate user devices cannot obtain IP addresses. section 11.2.1 section 11.6
• Combines spoofing with a DoS objective; it is not described as a DDoS attack unless multiple infected devices perform the attack. section 11.2.1

Figure 11.3 A DHCP exhaustion attack. The attacker sends countless DHCP DISCOVER messages with spoofed MAC addresses, exhausting the target DHCP server’s pool. As a result, legitimate user devices cannot receive IP addresses.

Visualizes spoofed DHCP DISCOVER messages exhausting the target server’s pool and blocking legitimate address allocation. section 11.2.1

How Acing the CCNA Exam: Volume 2 Advanced Networking and Security covers it

How deep it goes

Explains the message type, spoofed identity, exhausted resource, and service impact without covering mitigation or configuration.

Examples

Uses repeated DHCP DISCOVER messages carrying spoofed MAC addresses to illustrate address-pool exhaustion.

What you can do after

Evaluate attack traffic by identifying spoofed DHCP DISCOVER messages, pool exhaustion, and failed legitimate address allocation.

How it connects

Connects DHCP exhaustion with spoofing attacks and denial-of-service attacks.

liveBookmanning.com

Read Acing the CCNA Exam: Volume 2 Advanced Networking and Security on liveBook Get the book at manning.com

Related concepts

• denial-of-service attackkind of · A denial-of-service attack is an attempt to make a system or service unavailable or degrade its ability to serve legitimate users by exhausting or disrupting its resources.
• mac flooding attackproduces · A MAC flooding attack is a Layer 2 attack that fills a switch's MAC address table with spoofed addresses so frames are flooded instead of selectively forwarded.
• port securityaddressed by · Port security is a network-switch control that restricts a switch port to authorized device addresses or connection conditions and defines responses to violations.
• DHCP-based attackkind of · A DHCP-based attack is a network attack that exploits vulnerabilities in the Dynamic Host Configuration Protocol or its handling.

This explainer was generated by Manning's knowledge graph from the text of Acing the CCNA Exam: Volume 2 Advanced Networking and Security. The section links point to the parts of the book it draws on.