9.4.2 Rogue DHCP

9.4.2 Rogue DHCP The Dynamic Host Configuration Protocol (DHCP) provides IP addressing autoconfiguration to hosts. If a Windows client fails to obtain a DHCP lease, it defaults to using an address in the Automatic Private IP Addressing (APIPA) range of 169.254.0.0 It will be limited to communication with other APIPA hosts on the same network segment (broadcast domain). Linux hosts will use the 169.254.0.0 range if they have Zeroconf support, leave the IP address set to 0.0.0.0, or disable IPv4 on the interface.Clients have no means of preferring a DHCP server. If two DHCP servers are running on the same subnet, clients could end up with an incorrect IP configuration because they have obtained a lease from a rogue server. A rogue DHCP server may be deployed accidentally (forgetting to disable a DHCP server in an access point or router, for instance) or may be used by a malicious threat actor to subvert the network. A threat actor would normally use a rogue server to change the default gateway and DNS resolver addresses for the subnet and route communications via their machine. This is a means of using DHCP to facilitate an on-path attack.A DHCP starvation attack uses bogus requests to use up leases in a legitimate DHCP server's address pool. An exhausted DHCP scope means legitimate hosts cannot obtain a lease. A DHCP starvation attack might be a denial of service (DoS) mechanism or be used to force legitimate hosts to obtain a lease from a rogue DHCP server.