DHCP Snooping
Things we’ll
cover
●
What is DHCP Snooping?
●
How does it work?
●
What attacks does it prevent?
●
DCHP Snooping configuration
DHCP
Snooping
●
DHCP snooping is a security feature of switches that is used to filter DHCP
messages received on untrusted ports.
●
DHCP snooping only filters DHCP messages. Non-DHCP messages
aren’t affected.
● All ports are untrusted by default.
→Usually, uplink ports are configured as trusted ports, and downlink ports remain
untrusted.
downlinks = untrusted
uplinks = trusted
PC1
*DHCP server
or
PC2
relay agent
R1 SW SW
2 1
PC3
DHCP
Snooping
●
DHCP snooping is a security feature of switches that is used to filter DHCP
messages received on untrusted ports.
●
DHCP snooping only filters DHCP messages. Non-DHCP messages
aren’t affected.
● All ports are untrusted by default.
→Usually, uplink ports are configured as trusted ports, and downlink ports remain
untrusted.
Check: OK, Check: OK, DHCP message
forward as forward as
normal normal
PC1
*DHCP server
or PC2
relay agent DHCP message
R1 SW SW
2 1
PC3
DHCP
Snooping
●
DHCP snooping is a security feature of switches that is used to filter DHCP
messages received on untrusted ports.
●
DHCP snooping only filters DHCP messages. Non-DHCP messages
aren’t affected.
● All ports are untrusted by default.
→Usually, uplink ports are configured as trusted ports, and downlink ports remain
untrusted.
Check: Not
OK,
discard PC1
*DHCP server
or
relay agent
x DHCP
PC2
R1 SW SW message
2 1
PC3
DHCP Starvation
● An example of a DHCP-based attack is a DHCP starvation attack.
● An attacker uses spoofed MAC addresses to flood DHCP Discover messages.
●
The target server’s DHCP pool becomes full, resulting in a denial-of-service to
other devices.
CHADDR = Client Hardware Address
→Indicates the MAC address of the
x
DHCP POOL
client FULL :
DHCP Discover
(
CHADDR: [Link].11.22.33
DHCP Discover
CHADDR:
[Link].44.55.66
DHCP Discover
DHCP Poisoning (Man-in-the-Middle)
● Similar to ARP Poisoning, DHCP Poisoning can be used to perform a Man-in-the-Middle
●
attack.
A spurious DHCP server replies to clients’ DHCP Discover messages and assigns them IP
addresses, but makes the clients use the spurious server’s IP as the default gateway.
●
*Clients usually accept the first Offer message they receive.
●
This will cause the client to send traffic to the attacker instead of the legitimate default
gateway.
The attacker can then examine/modify the traffic before forwarding it to the legitimate
default gateway.
PC1 DISCOVER
Attack R1
[Link]/
er 24
Spuriou Legitimat
DHCPs . . DHCP
e
Server 2 1 Server
DHCP Poisoning (Man-in-the-Middle)
● Similar to ARP Poisoning, DHCP Poisoning can be used to perform a Man-in-the-Middle
●
attack.
A spurious DHCP server replies to clients’ DHCP Discover messages and assigns them IP
addresses, but makes the client use the spurious server’s IP as the default gateway.
●
*Clients usually accept the first OFFER message they receive.
●
This will cause the client to send traffic to the attacker instead of the legitimate default
gateway.
The attacker can then examine/modify the traffic before forwarding it to the legitimate
default gateway.
The attacker’s OFFER
arrives first = PC1 will
PC1 accept it.
Attack R1
[Link]/
er OFFER 24 OFFER
Spuriou Legitimat
DHCPs . . DHCP
e
Server 2 1 Server
DHCP Poisoning (Man-in-the-Middle)
● Similar to ARP Poisoning, DHCP Poisoning can be used to perform a Man-in-the-Middle
●
attack.
A spurious DHCP server replies to clients’ DHCP Discover messages and assigns them IP
addresses, but makes the client use the spurious server’s IP as the default gateway.
●
*Clients usually accept the first OFFER message they receive.
●
This will cause the client to send traffic to the attacker instead of the legitimate default
gateway.
The attacker can then examine/modify the traffic before forwarding it to the legitimate
defaultIP:gateway.
[Link]/
24 DG:
[Link]
PC1 DECLINE
REQUEST
Attack R1
[Link]/
er ACK 24
Spuriou Legitimat
DHCPs . . DHCP
e
Server 2 1 Server
DHCP Poisoning (Man-in-the-Middle)
● Similar to ARP Poisoning, DHCP Poisoning can be used to perform a Man-in-the-Middle
●
attack.
A spurious DHCP server replies to clients’ DHCP Discover messages and assigns them IP
addresses, but makes the client use the spurious server’s IP as the default gateway.
●
*Clients usually accept the first OFFER message they receive.
●
This will cause the client to send traffic to the attacker instead of the legitimate default
gateway.
The attacker can then examine/modify the traffic before forwarding it to the legitimate
defaultIP:gateway.
[Link]/
24 DG:
[Link]
PC1
Attack R1
[Link]/
er 24
Spuriou Legitimat
DHCPs . . DHCP
e
Server 2 1 Server
DHCP
Messages
●
When DHCP Snooping filters messages, it differentiates between DHCP Server
messages and DHCP Client messages
● Messages sent by DHCP Servers:
→ OFFER
→ ACK
→ NAK = Opposite of ACK, used to decline a client’s
REQUEST
● Messages sent by DHCP Clients:
→DISCOVER
→REQUEST
→RELEASE = Used to tell the server that the client no longer needs its IP
address
→DECLINE = Used to decline the IP address offered by a DHCP server
DHCP Snooping
Operations
●
If a DHCP message is received on a trusted port, forward it as normal without
inspection.
● If a DHCP message is received on an untrusted port, inspect it and act as
follows:
→ If it is a DHCP Server message, discard it.
→ If it is a DHCP Client message, perform the following checks:
DISCOVER/REQUEST messages: Check if the frame’s source MAC address and the
DHCP message’s CHADDR fields match. Match = forward, mismatch =
discard
RELEASE/DECLINE messages: Check if the packet’s source IP address and the
receiving interface match the entry in the DHCP Snooping Binding Table. Match =
forward, mismatch = discard
● When a client successfully leases an IP address from a server, create a new
entry in the
DHCP Snooping Binding Table.
DHCP
SW2(config)#ip dhcp snooping Snooping
SW2(config)#ip dhcp snooping vlan 1
SW2(config)#no ip dhcp snooping information I will explain this
option SW2(config)#interface g0/0
SW2(config-if)#ip dhcp snooping trust later!
SW1(config)#ip dhcp snooping
SW1(config)#ip dhcp snooping vlan 1 RELEASE/DECLINE messages will be checked to make
SW1(config)#no ip dhcp snooping information sure their IP address/interface ID match the entry in
option SW1(config)#interface g0/0
SW1(config-if)#ip dhcp snooping trust the DHCP snooping table.
SW1#show ip dhcp snooping binding
MacAddress IpAddress Lease(sec) Type Interface
VLAN
0C:29:2F:18:79:00 [Link] 86294 dhcp- 1 GigabitEthernet0/3
0 snooping
0C:29:2F:90:91:00
Total number of [Link] 86302 dhcp- 1 GigabitEthernet0/1
1 snooping
bindings: 3
0C:29:2F:67:E9:00 [Link] 86314 dhcp- 1 GigabitEthernet0/2
2 snooping G0/1 PC1
.1
G0/
G0/ G0/ G0/1 2 PC2
0 0 G0/0
R1 SW SW G0/
1
2192.168.100.0/ 3 PC3
24
DHCP Snooping Rate-Limiting
●
DHCP snooping can limit the rate at which DHCP messages are allowed to enter
●
an interface. If the rate of DHCP messages crosses the configured limit, the
●
interace is err-disabled.
Like with Port Security, the interface can be manually re-enabled, or
automatically re-enabled with errdisable recovery.
SW1(config)#interface range g0/1 – 3
SW1(config-if-range)#ip
*Jun dhcp snooping limit rate 1
5 13:15:14.180: %DHCP_SNOOPING-4-DHCP_SNOOPING_ERRDISABLE_WARNING: DHCP Snooping received 1 DHCP
packets on interface Gi0/1
*Jun 5 13:15:14.181: %DHCP_SNOOPING-4-DHCP_SNOOPING_RATE_LIMIT_EXCEEDED: The interface Gi0/1 is
receiving more than the threshold set
*Jun 5 13:15:14.182: %PM-4-ERR_DISABLE: dhcp-rate-limit error detected on Gi0/1, putting Gi0/1 in
err-disable
state 5 13:15:15.185: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed
*Ju
n state to down
*Ju 5 13:15:16.190: %LINK-3-UPDOWN: Interface GigabitEthernet0/1, changed state to down
n
G0/1 PC1
.1
G0/
G0/ G0/ G0/1 2 PC2
0 0 G0/0
R1 SW SW G0/
1
2192.168.100.0/ 3 PC3
24
DHCP Snooping Rate-Limiting
SW1(config)#errdisable recovery cause dhcp-rate-
limit
SW1#show errdisable recovery
ErrDisable Reason Timer Status
arp- Disable
inspection d
bpduguard Disable Rate-limiting can be very useful to
channel-misconfig d protect against DHCP exhaustion
(STP) dhcp-rate- Disable
limit d attacks.
inline-power
dtp-flap Disabled
Enabled
![output
gbic- omitted due to length]
invalid Disable
d
Disable
Timer interval: 300 secondsd
Interfaces that will be enabled at the next
timeout: Interface Errdisable
reason Time left(sec) Gi0/1 dhcp-rate-
limit 293
DHCP Option 82 (Information Option)
● Option 82, also known as the ‘DHCP relay agent information option’ is one of many DHCP
●
options.
It provides additional information about which DHCP relay agent received the client’s
●
message, on which interface, in which VLAN, etc.
●
DHCP relay agents can add Option 82 to messages they forward to the remote DHCP server.
With DHCP snooping enabled, by default Cisco switches will add Option 82 to DHCP
●
messages they receive from clients, even if the switch isn’t acting as a DHCP relay
agent.
By default, Cisco switches will drop DHCP messages with Option 82 that are received on
an untrusted
SW2#
*Jun 6 01:36:15.298: %DHCP_SNOOPING-5-DHCP_SNOOPING_NONZERO_GIADDR: DHCP_SNOOPING drop message
[Link]-
with
zero giaddr or option82 value on untrusted port, message type: DHCPDISCOVER, MAC sa:
0c29.2f67.e900 82 DISCOVER
DISCOVER
x G0/1 PC1
.
R1 G0/
1
G0/0 G0/1 PC2
2
G0/0 G0/0
SW2 SW1 G0/
[Link]/2 3
PC3
DHCP Option 82 (Information Option)
● Option 82, also known as the ‘DHCP relay agent information option’ is one of many DHCP
●
options.
It provides additional information about which DHCP relay agent received the client’s
●
message, on which interface, in which VLAN, etc.
●
DHCP relay agents can add Option 82 to messages they forward to the remote DHCP server.
With DHCP snooping enabled, by default Cisco switches will add Option 82 to DHCP
●
messages they receive from clients, even if the switch isn’t acting as a DHCP relay
agent.
By default, Cisco switches will drop DHCP messages with Option 82 that are received on
an untrusted port.
SW1(config)#no ip dhcp snooping information option
DISCOVER 82 DISCOVER DISCOVER
x G0/1 PC1
.1
R1 G0/
G0/0 G0/0 G0/1 2 PC2
G0/0
R1# SW2 G0/
*Jun 6 01:46:46.763: DHCPD:
inconsist6ent01:46:46.763: nSW1 3 PC3
19r2el.1ay68in.1DHCPD:
fo r m relay
0 0 .a0ti/2oinformation
4. option exists, but giaddr
*Jun is zero.
DHCP Option 82 (Information Option)
● Option 82, also known as the ‘DHCP relay agent information option’ is one of many DHCP
●
options.
It provides additional information about which DHCP relay agent received the client’s
●
message, on which interface, in which VLAN, etc.
●
DHCP relay agents can add Option 82 to messages they forward to the remote DHCP server.
With DHCP snooping enabled, by default Cisco switches will add Option 82 to DHCP
●
messages they receive from clients, even if the switch isn’t acting as a DHCP relay
agent.
By default, Cisco switches will drop DHCP messages with Option 82 that are received on
SW1(config)#no ip dhcp snooping information
an untrusted port.
option
SW2(config)#no ip dhcp snooping information
option DISCOVER DISCOVER DISCOVER
G0/1 PC1
.
R1 OFFER G0/
1
G0/0 G0/1 PC2
2
G0/0 G0/0
SW2 SW1 G0/
[Link]/2 3
PC3
Command Review
SW1(config)# ip dhcp snooping
SW1(config)# ip dhcp snooping vlan vlan-number
SW1(config)# errdisable recovery cause dhcp-rate-
limit SW1(config)# no ip dhcp snooping
information option SW1(config-if)# ip dhcp
snooping trust
SW1(config-if)# ip dhcp snooping limit rate
packets-per-second
SW1# show ip dhcp snooping binding
Things we’ll
cover
●
What is DHCP Snooping?
●
How does it work?
●
What attacks does it prevent?
●
DCHP Snooping configuration
Supplementary Materials
●
Packet Tracer lab