Configuring Defense Against DHCP Exhaustion Attacks

This section describes how to prevent the attackers from attacking the Dynamic Host Configuration Protocol (DHCP) server by forging the DHCP packets for extending IP address leases.

Applicable Environment

Attackers disguise as authorized clients to send DHCP request packets for extending the IP address lease. As a result, DHCP servers cannot reclaim IP addresses assigned to clients.

This problem can be resolved by enabling DHCP snooping. After DHCP snooping is enabled, when receiving a DHCP request packet, the device checks whether the IP address and VLAN ID carried in the packet match an entry in the DHCP snooping binding table. If no matching entry exists, the device considers the DHCP request packet as a new request packet and forwards it. If a matching entry exists, the device considers the DHCP request packet as a lease renewal packet and checks whether the MAC address carried in the packet matches any entry in the binding table. If a matching entry exists, the device forwards the packet. If no matching entry exists, the device discards the packet.

Pre-configuration Tasks

Before you configure defense against attacks by sending bogus DHCP packets to extend IP address leases, configure the DHCP server.

Copyright © Huawei Technologies Co., Ltd.
Copyright © Huawei Technologies Co., Ltd.
< Previous topic Next topic >