DEV Community

andreagomez
andreagomez

Posted on

Rogue DHCP servers and the layer-2 trust that makes them work

#networksecurity #dhcp #segmentation #layer2

Rogue DHCP servers and the layer-2 trust that makes them work

The Dynamic Host Configuration Protocol hands a device the address it will use, the router it should send traffic to and the name servers it should query. RFC 2131 defines the protocol and its message flow. RFC 3118 adds authentication for DHCP messages, and it is rarely deployed.

The trust model

A client broadcasts a request and accepts a response from whichever server answers first. Nothing in the base protocol lets the client verify that the response came from the network it believes it joined. An attacker on the same broadcast domain who answers before the legitimate server supplies the client with a gateway and resolver under their control, and the client will use them.

Failure points

  • Unsegmented networks where any device can reach the broadcast domain used for address assignment.
  • Test or lab DHCP servers connected to production segments.
  • Access points in bridge mode that extend the broadcast domain beyond the location where it was intended.
  • DHCP snooping enabled on the core switches but not on the access layer where the risk exists.
  • Devices set to act as a DHCP server because a configuration rollback restored an old role.

Controls

  • Enable DHCP snooping on access switches and define trusted ports explicitly, so responses from untrusted ports are discarded.
  • Segment the network so that a single broadcast domain does not span different security zones, and apply the segregation principles described in NIST SP 800-53 Rev 5.
  • Monitor for DHCP offers from unexpected sources and alert on them, since the event is uncommon in a stable network.
  • Avoid unauthenticated bridging where it is not required, and inventory access points that operate in bridge mode.
  • Confirm that a build process does not leave a device with the DHCP server role enabled by default.

Verification

Review the DHCP snooping configuration on the access layer, confirm the trusted port list, and check whether any segmented network permits broadcast traffic between zones.

References

Top comments (0)