What is DHCP starvation?

DHCP starvation is a network attack that targets the Dynamic Host Configuration Protocol (DHCP) server. DHCP is a protocol used to automatically assign IP addresses and other network configuration parameters to devices on a network. In a DHCP starvation attack, an attacker floods the DHCP server with a large number of requests for IP addresses, rapidly depleting the server's pool of available addresses.

How DHCP starvation works

The DHCP starvation attack works by taking advantage of the way DHCP servers manage IP address allocation. When a client device joins a network, it sends a DHCP request to the server, which then assigns an available IP address to the client. In a DHCP starvation attack, the attacker uses scripts or tools to generate a large number of fake DHCP requests, each with a unique Media Access Control (MAC) address. This floods the DHCP server with requests, causing it to exhaust its pool of available IP addresses.

Once the DHCP server's address pool is depleted, it is unable to assign new IP addresses to legitimate client devices joining the network. This results in a denial of service, as new clients are unable to connect to the network. The attacker may also be able to obtain a valid IP address from the depleted pool, which could then be used to launch further attacks on the network.

Impacts of DHCP starvation

The primary impact of a DHCP starvation attack is a denial of service, where new devices are unable to join the network due to the exhaustion of available IP addresses. This can disrupt normal network operations and prevent users from accessing essential resources and services.

Additionally, if the attacker is able to obtain a valid IP address from the depleted pool, they could potentially use that address to launch other types of attacks, such as man-in-the-middle attacks, network sniffing, or unauthorized access to network resources.

Mitigating DHCP starvation attacks

To mitigate the risk of DHCP starvation attacks, network administrators can implement the following best practices:

Implement DHCP snooping: DHCP snooping is a security feature that monitors DHCP traffic on the network and filters out potentially malicious DHCP requests. It maintains a DHCP snooping table that tracks the binding between a client's MAC address and its assigned IP address, allowing the network to detect and block unauthorized DHCP requests.
Limit DHCP lease duration: Reducing the duration of DHCP leases can help mitigate the impact of a DHCP starvation attack. By quickly recycling IP addresses, the DHCP server can more effectively serve legitimate clients.
Use port security: Configuring port security on network switches can help limit the number of devices that can connect to a single port, reducing the impact of a DHCP starvation attack.
Monitor and analyze DHCP traffic: Regularly monitoring and analyzing DHCP traffic can help identify potential DHCP starvation attacks and allow network administrators to take appropriate actions to mitigate the threat.

Real-world example

In 2018, a large retail chain experienced a DHCP starvation attack that disrupted its in-store network and point-of-sale systems. The attack was initiated by an attacker who used a script to generate a large number of DHCP requests, exhausting the available IP addresses on the DHCP server. This resulted in a denial of service, preventing new devices from connecting to the network and disrupting critical business operations. The company was forced to manually allocate IP addresses to devices to restore network functionality, and it also implemented DHCP snooping and other security measures to prevent similar attacks in the future.