
707070
© 2002, Cisco Systems, Inc. All rights reserved.
l2-security-bh.ppt
DHCP Starvation Attack Mitigation
¥ Same techniques that mitigate CAM flooding, can mitigate DHCP
starvation but not the Rogue DHCP server (from the DHCP RFC
2131):
ÒThe client collects DHCPOFFER messages over a period of time, selects one DHCPOFFER
message from the (possibly many) incoming DHCPOFFER messages (e.g., the first
DHCPOFFER message or the DHCPOFFER message from the previously used server) and
extracts the server address from the 'server identifier' option in the DHCPOFFER
message. The time over which the client collects messages and the mechanism used to
select one DHCPOFFER are implementation dependent.Ó
¥ RFC 3118 ÒAuthentication for DHCP MessagesÓ will help, but has yet
to be implemented
¥ Consider using multiple DHCP servers for the different security
zones of your network
¥ DHCP Option 82 on the 3550 can help:
http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/1219ea1/3550
scg/swdhcp82.htm
¥ Cisco is developing a DHCP ÒfirewallÓ for initial implementation in
our higher-end switches
Komentarze do niniejszej Instrukcji