Enabling Unauthorized Dhcp Server Detection; Enabling Dhcp Starvation Attack Protection - HP A5120 EI Series Configuration Manual

 If the IP address is no longer in use, the server either returns a DHCP-ACK message or does not
return any message within the specified interval, and the DHCP relay agent ages out the client entry.
When receiving the DHCP-ACK message, the DHCP relay agent sends a DHCP-RELEASE message to
release the IP address.
Follow these steps to configure periodic refresh of dynamic client entries:
To do...
Enter system view
Enable periodic refresh of
dynamic client entries
Configure the refresh interval

Enabling unauthorized DHCP server detection

Unauthorized DHCP servers may assign wrong IP addresses to DHCP clients.
With unauthorized DHCP servers detection enabled, the DHCP relay agent checks whether a request
contains Option 54 (Server Identifier Option). If yes, the DHCP relay agent records the IP address of each
detected DHCP server that assigned an IP address to a requesting DHCP client. It also records the
receiving interface. The administrator can use this information to check for unauthorized DHCP servers.
Follow these steps to enable unauthorized DHCP server detection:
To do...
Enter system view
Enable unauthorized DHCP server
detection
NOTE:
The DHCP relay agent logs a DHCP server only once.

Enabling DHCP starvation attack protection

A DHCP starvation attack occurs when an attacker constantly sends forged DHCP requests using different
MAC addresses in the chaddr field. This exhausts the IP address resources of the DHCP server are
exhausted so legitimate DHCP clients cannot obtain IP addresses. The DHCP server may also fail to work
because of exhaustion of system resources.
To relieve a DHCP starvation attack that uses DHCP packets encapsulated with different source MAC

addresses, you can limit the number of ARP entries that a Layer 3 interface can learn. You can also
configure an interface that has learned the maximum MAC addresses to discard packets whose
source MAC addresses are not in the MAC address table.
 To prevent a DHCP starvation attack that uses DHCP requests encapsulated with the same source
MAC address, enable MAC address check on the DHCP relay agent. With this function enabled,
the DHCP relay agent compares the chaddr field of a received DHCP request with the source MAC
Use the command...
system-view
dhcp relay security refresh
enable
dhcp relay security tracker {
interval | auto }
Use the command...
system-view
dhcp relay server-detect
55
Remarks
—
Optional
Enabled by default.
Optional
auto by default. (auto interval is calculated
by the relay agent according to the
number of client entries.)
Remarks
—
Required
Disabled by default.