DHCP Snooping
"DHCP stands for Dynamic Host Configuration Protocol and operates at layer seven, which is the application layer of the OSI model. It assigns IP addresses to network endpoints, operating at layer three of the OSI model, known as the Network layer.
Here we have a network switch. One of its ports is connected to an authorized DHCP server, while another port is connected to a client seeking an IP address automatically from this DHCP server. The client initiates by sending a DHCP Discover message. The DHCP server responds with a DHCP Offer message. The client then sends a DHCP Request message, and the DHCP server completes the process with a DHCP Acknowledgement message. The client receives an IP address from the DHCP server's pool, along with other network configurations like DNS server and Gateway IP address. Using these configurations, the client communicates over the network.
However, there's a vulnerability in this process. A hacker could set up a rogue DHCP server and offer fake DHCP configurations to the client in response to its DHCP Discover message. These rogue configurations might include a fake Gateway IP address. As a result, the client would send all its traffic to the hacker's machine, allowing the hacker to conduct a man-in-the-middle attack by intercepting and forwarding the client's traffic to the actual Gateway.
Another security issue arises when a hacker connects to a switch port and sends multiple DHCP Request messages, each with a different MAC address. This causes the DHCP server to deplete all IP addresses in its pool, resulting in a DHCP Starvation Attack. Consequently, legitimate clients won't be able to obtain IP addresses from the DHCP server, preventing them from connecting to the network.
To mitigate such attacks, switches implement a security feature called DHCP Snooping. When enabled, DHCP Snooping designates switch ports as either trusted or untrusted for DHCP server connections. Untrusted ports cannot receive DHCP Offer messages, preventing rogue DHCP servers from operating. Additionally, after the DHCP Acknowledgement packet, the switch creates an entry in the DHCP Snooping binding table, associating the client's port, MAC address, and IP address. This prevents the hacker from executing DHCP Starvation Attacks by limiting each port to a single MAC address.
Thank you."