Subject: [dhcwg] DHCP Security threat.

From: Senthil Kumar B <[email-masked]>
Date: Thu, 06 Mar 2003 21:16:38 +0530

RFC 2131 doesn't mandate the DHCP server to check whether a request is 
from a standard client port(68).  If this is being the case, a normal 
user can just write a program and send continuous DHCP request(series of 
DHCPDISCOVER, DHCPREQUEST) without bothering the reply from the server 
which eventually causes the IP address pool to exhaust. It's a DoS.

What is the mechanism used to prevent these kind of DoS attacks?

I understand "Authentication to DHCP messages" RFC Shares key 
information between reliable clients which the administrator will 
cofigure. But again, one out of the reliable clients can do this job and 
exhaust the pool which is simply a DoS.

Please advise how should it be handled.

Thanks,
Senthil K Bala.

_______________________________________________
dhcwg mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/dhcwg

---

From: "Bernie Volz (EUD)" <[email-masked]>
Date: Thu, 6 Mar 2003 10:08:23 -0600

Senthil:

Many stacks have no security and if a hacker is going to do this, they can also likely get by any security measures that are in place to require "privileges" to use a low port number (<1024). Also, the act of sending the packets and having the server have to process them to discard those packets from improper ports can result in a DoS attack (since the server and network will be much slower).

- Bernie

-----Original Message-----
From: Senthil Kumar B [mailto:[email-masked]]
Sent: Thursday, March 06, 2003 10:47 AM
To: dhcwg
Subject: [dhcwg] DHCP Security threat.

Thanks,
Senthil K Bala.