Potential DHCP Starvation via High Client MAC Cardinality

DHCP starvation is a denial-of-service technique targeting the availability of network addresses on a local segment. By transmitting a high volume of DHCP DISCOVER requests with distinct or spoofed client hardware addresses, an attacker can consume all available addresses in a DHCP server's scope. This often precedes the deployment of a rogue DHCP server to perform man-in-the-middle attacks. Detection requires monitoring raw packet captures for high cardinality of unique MAC addresses in DHCP DISCOVER transactions.

Attack Chain

1. Attacker gains access to a network segment (L2/VLAN).
2. Attacker initiates DHCP starvation by generating a rapid burst of DHCP DISCOVER messages.
3. Attacker uses spoofed or randomized MAC addresses for each request to appear as distinct clients.
4. DHCP server receives the high volume of requests and allocates leases until the pool is exhausted.
5. Legitimate network clients are denied IP addresses, resulting in a loss of network connectivity.
6. Attacker deploys a rogue DHCP server to respond to subsequent requests, facilitating traffic interception.

Impact

Observed impact includes total exhaustion of the DHCP lease pool, preventing legitimate devices from obtaining IP addresses. Successful exploitation often acts as a precursor to unauthorized network traffic interception via rogue DHCP server deployment.

Recommendation

• Implement DHCP snooping and rate-limiting on access layer switches to prevent high-frequency DISCOVER bursts from single ports.
• Establish monitoring for DHCP server health, specifically tracking spikes in NAK responses and address pool utilization.
• Review network traffic sensor logs for high-cardinality MAC address activity associated with DHCP DISCOVER messages.
• Isolate suspected hosts generating disproportionately high volumes of DHCP requests upon confirmation.