How can I protect my dhcpd application on a Debian system from DHCP starvation attacks? Is there any option in the .conf file?

  • 1
    Give IP addresses based on MAC. If you have too many machines to do that, you can hire somebody to solve the problem for you. – Satō Katsura Mar 15 '17 at 13:08
  • This is a public network. I was just wondering if there was an option within the application itself to protect against this. – Stephen Mar 15 '17 at 13:11
  • 1
    large subnets and short lease times – ivanivan Mar 15 '17 at 13:30
  • 1
    Which dhcp server are you using? – ilkkachu Mar 15 '17 at 13:47
  • 2
    @Stephen, yes, but which DHCP server program? ISC:s DHCP server in the isc-dhcp-server package? dnsmasq? Some other? Or do you just want an answer for some DHCP server, any one? – ilkkachu Mar 15 '17 at 14:21

The layer 2 network should be protected, means that security measure must be in place: dhcp snooping (bind ip:mac in database) dynamic arp inspection (work hand in hand with dhcp snooping) port security - be strict, one mac address per access port if not trunking

By doing this, you can guarantee, when a device is plug into the network that it is unique

Configure DHCP server to only offer ip address to a known set of MAC address

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.