How do you mitigate DHCP starvation?
Similar to port security in unshared wired networks, if a user’s physical identity or location can be pinpointed, DHCP starvation attacks can be mitigated by limiting the number of allowed MAC addresses originating from a client in a shared network.
Which two Cisco solutions help prevent DHCP starvation attacks?
Which two Cisco solutions help prevent DHCP starvation attacks? (Choose two.)
- Port Security.
- IP Source Guard.
- DHCP Snooping.
- Web Security Appliance.
- Dynamic ARP Inspection. Answers Explanation & Hints: Cisco provides solutions to help mitigate Layer 2 attacks including these:
How does DHCP starvation attack work?
How Does a DHCP Starvation Attack Work? In a DHCP Starvation attack, a hostile actor sends a ton of bogus DISCOVER packets until the DHCP server thinks they’ve expended their available pool. Clients looking for IP addresses find that there are no IP addresses for them, and they’re denied service.
Which tool can be used for DHCP starvation?
dhcpstarv is tool that implements DHCP starvation attack. It requests DHCP leases on specified interface, save them and renew on regular basis. When a rogue DHCP server appear in network with DHCP infrastructure some clients can get wrong network settings.
What is the result of a DHCP starvation?
Legitimate clients are unable to lease IP addresses. Clients receive IP address assignments from a rogue DHCP server. The attacker provides incorrect DNS and default gateway information to clients.
How do you protect against rogue DHCP server attacks?
What about preventing rogue DHCP servers?
- Look for IP address conflicts.
- Keep a properly documented network.
- Use Active Directory to authorize DHCP servers.
- Use DHCP snooping and trusted ports on your switches.