Re: DHCP and secondaries

[Christopher Davis <[e-mail]>]

Excerpts from netdev.dhcp-v4: 17-May-96 Re: DHCP and secondaries  by
"Edie E. Gunter"@watson. 
> >  I would like to require that the
> > users of our dhcp service register the hardware addresses
> > of their NIC cards before the server allows the client to
> > be services from either an automatic or dynamic pool.
>  
> I'd be curious to know why.  The authentication proposal
> you mention allows clients to be assured that the DHCP
> responses are from legitimate servers.  However, if a 
> server refuses to serve a particular client, that client
> can still commandeer an IP address that the server "owns."
> If a rogue client has physical access to the lan, there's 
> really no way to prevent it from claiming addresses from
> either one of your address pools.  (Oh, perhaps with a sniffer 
> or similar tool you can detect the rogue and on TR send it 
> KILL frames or some such.  There's also been talk
> about how to manage this problem with internal fire walls,
> but those are all ways to react to the problem, not how
> to prevent it.)

He's referring to dhcp servers serving ip addresses to legitimate
clients. Not the reverse. The idea is, I only serve addresses to
machines that I know about. If you don't have that many dynamic ip's
availible, you don't want to hand ip's to just anyone. Here at CMU, when
creating the dhcp server, this was one of our first requirments.


Chris Davis
Network Development
Carnegie Mellon University