Re: Possible DHCP DOS attack

[BlueBoar () THIEVCO COM (Blue Boar)]

> Has this already been addressed?  Am I missing something
> fundamental about DHCP?

No, you're right.  This type of DoS attack works fine.  In fact, if you
put up a Windows NT RAS server, and tell it to get it's address pool
from DHCP, it will happily grab as many DHCP addresses as you tell it.
These are pretty easy to spot on the DHCP server, as the "MAC" addresses
end up being I think three bytes longer than normal (the first bytes
spell out "RAS").

As for protecting against such attacks...

If someone is spoofing their layer 2 address, you'll have to catch that
with your network gear, and quickly.  Most equipment will only
cache the MAC addresses for 15-30 minutes.  Your DHCP server may
not have much opportunity to protect itself directly..  many sites
have DHCP servers set up across routers, so the DHCP server never
gets to see the original MAC address.

                                        BB