📚 DHCP

Dynamic Host Configuration Protocol. Listening on 67 port. Sending from 68.

Mechanism

DHCP Discover (Broadcast) C-> S

[new PC] 🧸 “I need an IP, I am new here. Only have this stupid useless 169.254.X.X address. Where do I register? Guys! Who knows where the DHCP is?”

DHCPDISCOVER is broadcasted in the network. Every machine, even non-DHCP once, hear this message.

DHCP Offer (Broadcast/Unicat) S -> C

[DHCP server] 🥸 “I’m DHCP. How can I help?”

DHCP server sends a DHCPOFFER to the [new PC] offering its help.

DHCP Request (Broadcast) C -> S

[new PC] 🧸 “I want an IP!”

PC in question responds with a DHCPREQUEST packet.

DHCP Ack (Broadcast/Unicat) S -> C

[DHCP server] 🥸 “Here you are. Fetch your configs also!” DHCP sends the PC IP address with the settings in a DHCPACK packet and put this data into its registry table as well, striking through the IP already in use now.

Mnemonics - DORA (Discover, Offer, Request and Acknowledge)

📘 BTFM

ipconfig \refresh # Windows

DHCP starvation

Get a legitimate DHCP down, become a DHCP server for the network, config PCs with the new GW (gateway), DNS, domain, subnet mask, IP etc. Get the legitimate DHCP down and set up a rougue one. All traffic comes through the fake DHCP. Step 1. Change local MAC address so that DHCP thinks I’m someone else. Step 2. Send a lot of (hunderds, thousands) DHCPREQUESTs thus delpleting the server’s pool of available IP addresses. The overwhelmed and terrified legitimate DHCP crashes. Step 3. Introduce my own rogue DHCP server.

DHCP Snooping

Prevents DHCP starvation. It’s a layer 2 sec switch which blocks unauthorized DHCP servers. Switch have trusted and untrusted ports. Legitimate DHCP is connected to the trusted one when first set up. All other devices, even local machines, become untrusted.

1. Switch will drop all DHCPOFFER, DHCPACK, DHCPNACK from untrusted ports.
2. Drop requests for release/decline DHCPOFFER if these messages do not originate on the original machine then has send a DHCPREQUEST. This way attacker won’t be able to terminate/decline the DHCP offer from the client’s behalf.
3. ❓ DHCP relay agent forwards a DHCP packet that includes a relay agent IP != 0.0.0.0 or includes option 82 to an untrusted port.
4. If source MAC (Ethernet) != client MAC (bootstrap protocol) - drop.

If either of the above scenarios happen, it’s logged. Apart from that, the switch will log the following:

1. MACs of untrusted ports (UP).
2. Leased addresses of UP.
3. Lease time.
4. Binding time.
5. VLAN/interface the UP is associated with.

On lease time expiration or DHCPRELEASE, cleanup of the corrsponding entry in the DHCP Snooping Binding DB. DHCP assigns addresses, switch filters, logs and forwards. Switch/router = DHCP relay agent.

Tools

Reference