DHCP Snooping could be implemented to mitigate Rogue DHCP servers by restricting DHCP server messages to Trusted Ports.
Control Type: Technical
Control Function: Preventive
Description: Almost all enterprise networks utilize the Dynamic Host Configuration Protocol (DHCP) to provide devices with IP addresses so that they can properly communicate and access network resources. This process involves administrators setting up a DHCP Server with a pool of available IP addresses according to the organization's IP addressing scheme and subnets. DHCP servers can host multiple different address pools to serve IPs to multiple different subnets.
Once a client device has authenticated to the company network, it reaches out to the DHCP server and get an IP address in a 4 step process:
- DHCP Discover: a client connects to the network and sends out a broadcast address to locate available DHCP servers.
- DHCP Offer: the DHCP server sees the Discover message and sends back a broadcast or unicast message offering a specific address configuration to the client
- DHCP Request: the client confirms the offer from the DHCP server and sends it a message asking for the address to be formally allocated
- DHCP Acknowledgment: the DHCP server sees the request and officially issues the offered IP address to the client
Adversaries residing within an enterprise network can set up their own DHCP servers to try and respond to DHCP Discover messages before the legitimate DHCP server. A malicious server might respond to DHCP Discover message quicker, directing client device's right into the adversary's hands. An adversary can also perform a DHCP starvation attack on the valid DHCP server to exhaust its IP address pool, thus portraying the malicious DHCP server as the sole true server for the network. Once they are issuing IP addresses to network clients with their own server, the adversary can setup man in the middle attacks where their own machine is used as the default gateway or DNS server to intercept traffic.
DHCP Snooping allows administrators to specify which network devices are allowed to transmit server-side DHCP messages. Valid DHCP Servers are configured on Trusted Ports, meaning they are whitelisted to provide DHCP services to the network. All other ports on the network are designated as Untrusted Ports. Generally, Trusted Ports will be used by network infrastructure devices such as routers, switches, and servers. Untrusted Ports are reserved for client end devices such as computers and printers.
The DHCP Snooping feature can also use rate limiting to mitigate DHCP starvation attacks. This is done by setting a ceiling on the number of DHCP messages that can transmit over untrusted ports in a set timeframe. This way, adversaries will not be able to spam DHCP requests to deplete the DHCP pool.
DHCP Snooping is turned off by default, so admins will need to begin configuration by enabling it. A Binding Table is then made to map the MAC addresses connected to untrusted ports with their DHCP assignment. Switches then begin tracking DHCP messages and comparing them with the binding table. The switch configuration must specify which VLANs to monitor with DHCP Snooping, as well as the switchport to use as the Trusted Port for relaying DHCP messages.
Once enabled and properly configured, DHCP Snooping will monitor activity on the selected ports. Untrusted Ports should only be sending out DHCP DISCOVER and DHCP REQUEST messages, since they are specifically client devices, and have no reason to be sending out DHCP server messages. If a DHCP server message such as DHCP OFFER and DHCP ACK is sent on an Untrusted Port, DHCP Snooping assumes there is a rogue DHCP server at play and discards the messages.
