<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: detecting-dhcp-attacks
description: >-
  Detect and mitigate DHCP attacks including starvation, rogue servers, and spoofing using DHCP snooping, Suricata rules, and network monitoring for LAN security.
domain: cybersecurity
subdomain: network-security
tags:
  - dhcp
  - dhcp-starvation
  - rogue-dhcp
  - dhcp-snooping
  - lan-security
version: "1.0"
author: defconxt
license: AGPL-3.0
compatibility: Designed for Claude Code, GitHub Copilot, OpenAI Codex, Cursor, Gemini CLI, and any agentskills.io-compatible agent.
metadata:
  mitre-attack: ["T1557", "T1200"]
  nist-csf: ["DE.CM-1", "PR.AC-5"]
  uuid: 7d4a48eb-0c09-4017-9ce9-f9081cf9d0af
---

# Detecting DHCP Attacks

## Overview

DHCP attacks target the dynamic address assignment infrastructure to enable man-in-the-middle,
denial of service, or network hijacking. DHCP starvation exhausts the address pool, rogue DHCP
servers provide malicious configurations (gateway, DNS), and DHCP spoofing intercepts client
traffic. Detection combines DHCP snooping, server monitoring, and network behavior analysis.

Mode: `[MODE: BLUE]` for detection; `[MODE: ARCHITECT]` for prevention design.

## Prerequisites

| Requirement | Details |
|---|---|
| DHCP server logs (ISC DHCP, dnsmasq, or Windows DHCP) | Required |
| Managed switches with DHCP snooping capability | Required |
| Network monitoring (Suricata, Wireshark) | Required |
| Baseline of authorized DHCP servers | Required |
| Network span/tap for passive monitoring | Required |

## Key Concepts

### DHCP Attack Types

```
Attack Types:
├── DHCP Starvation
│   ├── Attacker sends many DISCOVER with spoofed MACs
│   ├── Exhausts DHCP address pool
│   └── Denial of service for legitimate clients
├── Rogue DHCP Server
│   ├── Attacker runs unauthorized DHCP server
│   ├── Provides malicious gateway/DNS to clients
│   └── Enables MITM attacks
├── DHCP Spoofing
│   ├── Attacker responds to DISCOVER before legitimate server
│   ├── Assigns attacker-controlled gateway
│   └── Intercepts all client traffic
└── DHCP Release Attack
    ├── Sends forged RELEASE to server
    └── Forces clients to re-request (enables rogue server attack)
```

### DHCP Snooping

```bash
# Cisco switch — enable DHCP snooping
# ip dhcp snooping
# ip dhcp snooping vlan 10,20,30
# interface GigabitEthernet0/1
#   ip dhcp snooping trust  (uplink to real DHCP server)
# interface range GigabitEthernet0/2-48
#   ip dhcp snooping limit rate 10  (access ports)

# Linux — detect rogue DHCP servers
nmap --script broadcast-dhcp-discover -e eth0
```

### Suricata DHCP Detection Rules

```yaml
# DHCP starvation — many DISCOVER from one source
alert udp any 68 -> any 67 (msg:"DHCP Starvation - excessive DISCOVER"; \
  content:"|01 01|"; offset:0; depth:2; \
  content:"|01|"; offset:242; depth:1; \
  threshold:type both, track by_src, count 50, seconds 10; \
  sid:8000001; rev:1;)

# Rogue DHCP server detection
alert udp !$DHCP_SERVERS 67 -> any 68 (msg:"Rogue DHCP Server detected"; \
  content:"|02 01|"; offset:0; depth:2; \
  sid:8000002; rev:1;)
```

### Wireshark DHCP Filters

```
# All DHCP traffic
dhcp

# DHCP DISCOVER (starvation indicator if excessive)
dhcp.option.dhcp == 1

# DHCP OFFER (rogue server if from unexpected source)
dhcp.option.dhcp == 2

# DHCP ACK from non-authorized server
dhcp.option.dhcp == 5 and not ip.src == 10.10.10.1

# Unique client MAC analysis
dhcp.hw.mac_addr
```

## Workflow

### Step 1: Identify Authorized DHCP Servers

```bash
# Document authorized DHCP servers
nmap --script broadcast-dhcp-discover -e eth0
# Record: IP, MAC, offered range, gateway, DNS
```

### Step 2: Enable DHCP Snooping

Configure DHCP snooping on managed switches. Trust uplink ports only.

### Step 3: Deploy Detection Rules

Load Suricata DHCP rules. Set $DHCP_SERVERS variable to authorized server IPs.

### Step 4: Monitor DHCP Pool

```bash
# ISC DHCP — check lease utilization
dhcpd-pools -c /etc/dhcp/dhcpd.conf -l /var/lib/dhcp/dhcpd.leases
# Alert if pool > 90% utilized
```

### Step 5: Rogue Server Scan

```bash
# Periodic rogue DHCP detection
dhclient -n -v eth0 2>&1 | grep "DHCPOFFER"
# Compare offered server IP against authorized list
```

## Detection

```yaml
title: Dhcp Attacks Detection
id: bdaf09e7-6839-4bf4-afe3-2f723d4906f5
status: experimental
description: Detects suspicious activity related to detecting dhcp attacks techniques in network security context
logsource:
  category: firewall
  product: linux
detection:
  selection:
    Action: blocked
  condition: selection
level: medium
tags:
  - attack.t1557
  - attack.t1200
  - attack.command_and_control
falsepositives:
  - Network monitoring tools performing scheduled connectivity checks
```


**Detection Opportunities**

| Indicator | Source | Detection Logic |
|---|---|---|
| Dhcp Attacks Detection | linux/firewall | Sigma rule (medium) |
| ATT&CK Coverage | MITRE ATT&CK | T1557, T1200 |

## Verification

- [ ] DHCP snooping enabled on all access VLANs
- [ ] Only authorized DHCP servers on trusted ports
- [ ] Rate limiting on access ports (DHCP snooping limit)
- [ ] Suricata rules detect starvation and rogue servers
- [ ] DHCP pool utilization monitored and alerted
- [ ] Periodic rogue DHCP server scans scheduled
- [ ] Incident response procedure for DHCP attacks documented

## References

- MITRE ATT&CK T1557 — Adversary-in-the-Middle
- CIS Controls v8 Control 12: Network Infrastructure Management
- RFC 2131: Dynamic Host Configuration Protocol
- [ISC DHCP Documentation](https://www.isc.org/dhcp/)
