IT Security Stack Exchange
IT Security Stack Exchange

Questions tagged [dhcp]

57 questions
20
votes
4 answers

DHCP vs. Static IP Addressing

How do DHCP and Static IP addressing compare, from a security standpoint? What are the risks/benefits associated with each? I know the preferred solution between the two will vary with network size and layout, but I'm just looking for a more…
Iszi
  • 26,997
  • 18
  • 98
  • 163
16
votes
4 answers

Detecting(and locating) rogue DHCP server on a local area network

How would we detect and locate a rogue DHCP server on our local area network?
Satoshi
  • 161
  • 1
  • 1
  • 3
14
votes
3 answers

Is a predictable MAC address a risk?

If you knew from the public internet that a certain IP address belonged to a machine with a certain MAC address, can you see any security exposure associated with that? I know that some software will use a MAC address as an identifier, but I can't…
Jeff Ferland
  • 38,090
  • 9
  • 93
  • 171
10
votes
7 answers

How can I restrict access to network data by an unauthorized computer that connects via Ethernet?

I assume I can configure most routers to only assign IP addresses to specific MAC addresses, as is possible with wireless routers. However what if a computer is connected via Ethernet and does not ask for an IP address? What can they skim off the…
Wholemilk
  • 101
  • 1
  • 3
9
votes
2 answers

Is connecting to an open WiFi router with DHCP in Linux susceptible to Shellshock?

Source: http://lcamtuf.blogspot.com/2014/09/quick-notes-about-bash-bug-its-impact.html For the same reason, userland DHCP clients that invoke configuration scripts and use variables to pass down config details are at risk when exposed to rogue…
Deer Hunter
  • 5,297
  • 5
  • 33
  • 50
8
votes
4 answers

What are the biggest security concerns on PXE?

What are the top security concerns when setting up a PXE (Preboot Execution Environment) booting environment, ordered by severity of a possible exploitation? Things that I thought of are (in no particular order): Rogue DHCP…
RikuXan
  • 193
  • 1
  • 1
  • 7
7
votes
4 answers

What are the laws regarding ISP recording IP addresses? How would they know who had which?

Since most internet users have ISPs using dynamic IP addresses (e.g. someone gets a new external IP address every few days) are there any laws requiring the ISPs to keep logs associating an IP address on a certain day with a certain individual? For…
Celeritas
  • 10,039
  • 22
  • 77
  • 144
7
votes
2 answers

SIEM: Monitoring End Users and DHCP IP assigning issue

I want to monitor my end users activity for which I have selected Alien Vault as my SIEM solution. Now, when I see logs coming in and I see malicious activity at a certain IP (e.g 10.10.10.4) with host name XYZ, I start investigating and I see that…
Bilal Ahmad
  • 116
  • 6
6
votes
2 answers

Why is DHCP considered insecure?

Most places I've worked at consider DHCP to be a bad idea for management networks, or "secured" networks. I'm curious as to why that is. Consider this scenario... There is an ISCSI storage network, say, 10.1.1.0/24 Clients have an interface for…
thisguy123
  • 161
  • 1
  • 2
5
votes
1 answer

What is the simplest way to prevent adding a new default route via dhcp?

I have a corporate network to which remote access is provided via openvpn. Customers include a variety of devices (laptops, smartphones). These devices running software that accesses corporate resources. Transparency of the work for the customer is…
ivank0o
  • 51
  • 3
4
votes
1 answer

DHCP Starvation Attack doesn't work in my virtual lab

I've installed DHCP server in VirtualBox host-only network type. Other clients in VirtualBox can get their IP addresses successfully from my DHCP server. I've decided to attack this DHCP server and want to consume all ip adresses that it can serve.…
Pioneerhfy
  • 41
  • 1
4
votes
3 answers

How should I respond to an unrecognized client in my DHCP logs?

I've found a strange hostname in my dhcpd.leases file and I'm wondering what steps I should take in response. I have a simple home network: my modem is plugged into a router running OpenBSD 6.0, and a laptop and an old Netgear router in WAP mode are…
Ben
  • 141
  • 4
4
votes
1 answer

Cant access most websites using a fake AP created by aircrack-ng suite

The question , Setting up a fake AP - problem with iptables and DNS server , I posted before was answered and fixed, to not confuse people looking for the same problem in the future I wanted to post a new question that follows the problem I had but…
eyal360
  • 131
  • 1
  • 9
4
votes
1 answer

What are the security risks of using public address schemes for the DHCP of your VPN'd Users?

At the company I work for we recently purchased a network scanning tool to help with asset inventory and overall PC network management. My supervisor, while looking at the different IP address ranges for the various offices, noticed the range…
Eddie Studer
  • 1,049
  • 7
  • 17
3
votes
1 answer

How can I launch DHCP starvation attack in WLAN?

In WLAN, due to MAC association on Access Point (AP), I can't send the DHCPDISCOVER messages using random MAC addresses. But if I keep my original MAC address as the source ethernet MAC a and random MAC address in the CHADDR field of DHCP packet and…
user3894707
  • 31
  • 1
1
2 3 4