Enabling Dhcp Starvation Attack Protection; Enabling Dhcp-Request Message Attack Protection - HP 830 Series Configuration Manual

Step
3. Back up DHCP snooping entries to
the file.
4. Set the interval at which the DHCP
snooping entry file is refreshed.
After DHCP snooping is disabled with the undo dhcp-snooping command, the device deletes all DHCP
snooping entries, including those stored in the file.

Enabling DHCP starvation attack protection

A DHCP starvation attack occurs when an attacker constantly sends forged DHCP requests using
different MAC addresses in the chaddr field to a DHCP server. This exhausts the IP address resources of
the DHCP server so legitimate DHCP clients cannot obtain IP addresses. The DHCP server may also fail
to work because of exhaustion of system resources. You can protect against starvation attacks in the
following ways:
To relieve a DHCP starvation attack that uses DHCP packets encapsulated with different source
•
MAC addresses, you can limit the number of MAC addresses that a Layer 2 port can learn.
• To prevent a DHCP starvation attack that uses DHCP requests encapsulated with the same source
MAC address, you can enable MAC address check on the DHCP snooping device. With this
function enabled, the DHCP snooping device compares the chaddr field of a received DHCP
request with the source MAC address field of the frame. If they are the same, the request is
considered valid and forwarded to the DHCP server. If not, the request is discarded.
To enable MAC address check:
Step
Enter system view.
1.
2. Enter interface view.
3. Enable MAC address check.
Enabling DHCP-REQUEST message attack
protection
Attackers may forge DHCP-REQUEST messages to renew the IP address leases for legitimate DHCP
clients that no longer need the IP addresses. These forged messages keep a victim DHCP server renewing
the leases of IP addresses instead of releasing the IP addresses. This wastes IP address resources.
Command
dhcp-snooping binding
database update now
dhcp-snooping binding
database update interval
minutes
Command
system-view
interface interface-type
interface-number
dhcp-snooping check
mac-address
58
Remarks
Optional.
DHCP snooping entries are stored to
the file each time this command is
used.
Optional.
By default, the file is not refreshed
periodically.
Remarks
N/A
N/A
Disabled by default.
You can enable MAC address check
only on Layer 2 Ethernet interfaces
and Layer 2 aggregate interfaces.