3 ms·

I assume most guest wifi has some protection against this, if not, well shame on them.

by ck2 11y ago

bluedino 11y ago
This was an old trick to use at places with slow wifi. Exhaust the DHCP database with a short perl script. Everyone comes in asking why the wifi isn't working while you're still plugging away. Of course, the staff can 'fix it' by rebooting the router but eventually they'd quit because it only solves it for a few minutes. At this point you can start your own rogue AP and people will join that. These days it seems like most shops converted over to AP's that use wireless network segregation and are smart enough to not let one of those networks gobble up > 1 address.
- commandar 11y ago
  We had issues with this at work. We're a healthcare facility that grew faster than our IT infrastructure or admin expertise did. A couple of years ago, we started having issues with our wifi like you're describing. Connecting devices would work, but nothing new could join the network. The issue? DHCP lease times were set to 30 days in a facility where hundreds of transient devices per day could connect up to the wireless network. The IP pool unsurprisingly got exhausted. Our network engineer at the time was... not very good. It took two separate incidents with MDs complaining and me finally sniffing DHCP traffic on a spare laptop and emailing it to his boss to get it fixed.
- pbhjpbhj 11y ago
  >smart enough to not let one of those networks gobble up > 1 address // If you spoof your MAC then how would they know to only give one address? From the OP: >"Depending on the server's method of releasing IP addresses associated with a given MAC address this attack will either be more, or less effective. For example, if a server quickly releases allocations that it doesn't receive responses from, the attack will be less effective." Why not respond to the responses on all those MACs then, surely in promiscuous mode you could send responses (and even fake a little traffic) for each MAC used. My home router is preconfigured to allow only 253 connections (lease time 1 day) - seems you could easily mess with SOHO routers with this?
  - simoncion 11y ago
    > My home router is preconfigured to allow only 253 connections (lease time 1 day)... Why is your lease time so very, very long? Why not set it to something like 60 or 30 minutes? IIRC, devices will start renewing their leases long before they get to the expiry period, so it's not as if short leases do anything more than substantially increase what is almost certainly a minuscule amount of traffic on your LAN.
    - colanderman 11y ago
      My laptops are often asleep for more than 60 minutes at a time. When I open them up, I expect network availability pretty much immediately (I am rather impatient), and (preferably) my SSH sessions intact. If I set my DHCP server's lease time as you suggest, I would often have to wait several seconds for my laptop to reacquire an address after waking up if there was any packet loss in the DHCP handshake, and if I happened to get a different IP, my SSH sessions would die. Seeing as 99.9% of device-hours logged on my router are the same four devices, I have no reason not to have a long lease time (3 days, my router's default). It's not like I'm running a Starbucks.
      - simoncion 11y ago
        > If I set my DHCP server's lease time as you suggest, I would often have to wait several seconds for my laptop to reacquire an address after waking up if there was any packet loss in the DHCP handshake... Odd. My non-systemd machine gets an address long before I'm able to unlock the lock screen... and I'm a fast typer. It's entirely possible that my machine is an outlier, tho. :) > ...and if I happened to get a different IP, my SSH sessions would die. You don't have "static leases" for all of your known devices that live in a range that's not served to unknown devices? Anyway. Here's hoping that I hear from pbhjpbhj. :)
    - pbhjpbhj 11y ago
      As it happens I only have a max of about 15 devices ever (when friends are over) and AFAICT no one is trying to DDoS my router. Those settings were the default and there doesn't seem any reason for me to change it - my point was that exhausting all the leases should be easy. Of course then power-cycling is easy too, but then exhausting all the leases again would be super-annoying for a neighbour who hadn't got a clue what was going on. I did try with Yersinia but couldn't get it working immediately; perhaps there's protection built in?

I assume most guest wifi has some protection against this, if not, well shame on them.

by ck2 11y ago

I assume most guest wifi has some protection against this, if not, well shame on them.

This was an old trick to use at places with slow wifi. Exhaust the DHCP database with a short perl script. Everyone comes in asking why the wifi isn't working while you're still plugging away. Of course, the staff can 'fix it' by rebooting the router but eventually they'd quit because it only solves it for a few minutes. At this point you can start your own rogue AP and people will join that. These days it seems like most shops converted over to AP's that use wireless network segregation and are smart enough to not let one of those networks gobble up > 1 address.

commandar 11y ago
We had issues with this at work. We're a healthcare facility that grew faster than our IT infrastructure or admin expertise did. A couple of years ago, we started having issues with our wifi like you're describing. Connecting devices would work, but nothing new could join the network. The issue? DHCP lease times were set to 30 days in a facility where hundreds of transient devices per day could connect up to the wireless network. The IP pool unsurprisingly got exhausted. Our network engineer at the time was... not very good. It took two separate incidents with MDs complaining and me finally sniffing DHCP traffic on a spare laptop and emailing it to his boss to get it fixed.
pbhjpbhj 11y ago
>smart enough to not let one of those networks gobble up > 1 address // If you spoof your MAC then how would they know to only give one address? From the OP: >"Depending on the server's method of releasing IP addresses associated with a given MAC address this attack will either be more, or less effective. For example, if a server quickly releases allocations that it doesn't receive responses from, the attack will be less effective." Why not respond to the responses on all those MACs then, surely in promiscuous mode you could send responses (and even fake a little traffic) for each MAC used. My home router is preconfigured to allow only 253 connections (lease time 1 day) - seems you could easily mess with SOHO routers with this?
- simoncion 11y ago
  > My home router is preconfigured to allow only 253 connections (lease time 1 day)... Why is your lease time so very, very long? Why not set it to something like 60 or 30 minutes? IIRC, devices will start renewing their leases long before they get to the expiry period, so it's not as if short leases do anything more than substantially increase what is almost certainly a minuscule amount of traffic on your LAN.
  - colanderman 11y ago
    My laptops are often asleep for more than 60 minutes at a time. When I open them up, I expect network availability pretty much immediately (I am rather impatient), and (preferably) my SSH sessions intact. If I set my DHCP server's lease time as you suggest, I would often have to wait several seconds for my laptop to reacquire an address after waking up if there was any packet loss in the DHCP handshake, and if I happened to get a different IP, my SSH sessions would die. Seeing as 99.9% of device-hours logged on my router are the same four devices, I have no reason not to have a long lease time (3 days, my router's default). It's not like I'm running a Starbucks.
    - simoncion 11y ago
      > If I set my DHCP server's lease time as you suggest, I would often have to wait several seconds for my laptop to reacquire an address after waking up if there was any packet loss in the DHCP handshake... Odd. My non-systemd machine gets an address long before I'm able to unlock the lock screen... and I'm a fast typer. It's entirely possible that my machine is an outlier, tho. :) > ...and if I happened to get a different IP, my SSH sessions would die. You don't have "static leases" for all of your known devices that live in a range that's not served to unknown devices? Anyway. Here's hoping that I hear from pbhjpbhj. :)
  - pbhjpbhj 11y ago
    As it happens I only have a max of about 15 devices ever (when friends are over) and AFAICT no one is trying to DDoS my router. Those settings were the default and there doesn't seem any reason for me to change it - my point was that exhausting all the leases should be easy. Of course then power-cycling is easy too, but then exhausting all the leases again would be super-annoying for a neighbour who hadn't got a clue what was going on. I did try with Yersinia but couldn't get it working immediately; perhaps there's protection built in?