[dhcwg] DHCP Security threat.

[Senthil Kumar B <[e-mail]>]

RFC 2131 doesn't mandate the DHCP server to check whether a request is 
from a standard client port(68).  If this is being the case, a normal 
user can just write a program and send continuous DHCP request(series of 
DHCPDISCOVER, DHCPREQUEST) without bothering the reply from the server 
which eventually causes the IP address pool to exhaust. It's a DoS.

What is the mechanism used to prevent these kind of DoS attacks?

I understand "Authentication to DHCP messages" RFC Shares key 
information between reliable clients which the administrator will 
cofigure. But again, one out of the reliable clients can do this job and 
exhaust the pool which is simply a DoS.

Please advise how should it be handled.

Thanks,
Senthil K Bala.

_______________________________________________
dhcwg mailing list
[e-mail]
https://www1.ietf.org/mailman/listinfo/dhcwg