DHCPSpoofing

DHCPSpoofing is a network attack in which a malicious device or compromised DHCP server responds to client DHCP requests with falsified network configuration information. Because DHCP is a dynamic and unauthenticated protocol, a client may accept the first valid offer it receives, allowing an attacker to supply settings such as an IP address, a gateway, and DNS servers under the attacker’s control.

In typical scenarios, a client on a local network broadcasts a DHCPDISCOVER message to obtain configuration. An attacker on the same broadcast domain can reply with a DHCPOFFER that appears legitimate, potentially directing the client’s traffic through a rogue gateway or to malicious DNS servers. A rogue server can also participate in DHCP starvation attacks to exhaust the available IP pool, increasing the likelihood that a rogue offer is accepted. The lack of built-in DHCP authentication makes such spoofing possible without forced cryptographic verification.

Potential impacts include man-in-the-middle traffic interception, redirection of web requests to phishing or malicious sites through DNS manipulation, denial of service by misallocating IP resources, and broader network compromise if joined hosts are redirected into malicious segments. The attack can undermine confidentiality, integrity, and availability of network communications.

Defenses focus on network controls: DHCP snooping to distinguish trusted DHCP servers from rogue ones, and enforcing trusted-port configurations on switches; dynamic ARP inspection; network segmentation and VLAN segmentation to limit broadcast domains; static IP assignments for critical devices; monitoring and logging of DHCP activity; and rapid containment/response to detect and remove rogue DHCP servers.