4 ms·
DHCP snooping prevents rogue DHCP servers. I have only seen a handful of switches in orgs configured for hard limits MAC/lease per port. OOB most things will di
by accessleech2848 11y ago
DHCP snooping prevents rogue DHCP servers. I have only seen a handful
of switches in orgs configured for hard limits MAC/lease per port. OOB most things will dish up leases at will, how else are folks spinning up countless bridged VMs, containers, etc in workstations.
I appreciate you sharing that it doesn't seem new to you, could you share some of your examples so we can learn from your experience also?
- jlgaddis 11y ago> ... could you share some of your examples ... I used `yersinia` many years ago for this exact purpose (DHCP exhaustion). It supports attacking several layer 2 protocols as well.
- AndyMcConachie 11y agoDHCP snooping can do different things dependening on how it's configured. It can prevent ARP spoofing attacks, or DHCP server exhaustion, by limiting the amount of source IPs that can ingress a given port on a switch. To prevent this program from doing its evil, DHCP snooping could be configured to only allow one source IP address on a port. In fact, to prevent this kind of attack you don't even need DHCP snooping. Since it requires MAC spoofing you can configure the switch to only learn one MAC on that port, or only allow frames with a limited number of MACs to ingress the switch. Hope this helps. A while back I wrote opensourced some code I wrote for work that emulated IGMPv2 behavior of triple-play set top boxes. It's meant to stress IGMPv2 implementations, but it also emultates multiple DHCP clients. https://github.com/smutt/mcastClients/blob/master/mcastClients.py https://github.com/smutt/mcastClients/blob/master/mcastClien...
- NeutronBoy 11y ago> OOB most things will dish up leases at will, how else are folks spinning up countless bridged VMs, containers, etc in workstations. They are not in the 99.99% of corporate environments outside of startup-land.