DHCP_MindMap

DHCP_MindMap

1. What is it?

   • It's a network protocol used in IP networks where a DHCP server automatically assigns an IP address and other information to each host in the network so that they can communicate efficiently with other endpoints.
     • DHCP vs Manual Configuration
       • Pros:- Minimize errors - Ease of maintenance: a change of address, mask or DNS is done directly on the server. - Provides configuration automatically. - Allow reuse of addresses.
       • Cons: It is necessary to ensure the operation of the DHCP service (high availability).

2. DHCP Types

   • Manual
     • The IP address is associated with the MAC address of the client
   • Dynamic
     • The server offers a custom address for a limited time (lease time).
   • Permanent
     • The address assigned to the client remains permanently associated (unlimited lease time).

3. Well Known Port

   • The client uses a well known port and not an ephemeral port because there can only be one DHCP client per team.

4. DHCP Negotiation How does it work?

   • Step 1 The client sends a DHCP DISCOVER Package to the Server
     • Step 2 The server replies via a DHCP OFFER
       • Step 3 After the OFFER, the Client replies again, but this time, with a DHCP REQUEST
         • Step 4 Depending on whether or not the Server has an address for the Client, it will reply with a DHCP ACK Package if it does, or a DHCP NAK Package if it doesn't

5. DHCP Relay

   • It is an intermediary who receives the DHCP requests from Clients and redirects them to the server.

6. DHCP Attack Protocols

   • The DHCP Protocol is weak to these attacks
     • DHCP Starvation
       • Flood the DHCP server with false requests, so That there are no free addresses in the network.
     • DHCP Spoofing DHCP ACK Injection
       • We intercept the package request from the client and we send the ACK with the modified configuration
     • DHCP Rogue
       • Fake DHCP server which we use to configure the network
   • Defensive Measures
     • Monitoring and detection tools of Unauthorized DHCP Packages (Snort).
     • DHCP Snooping, where the Switch blocks the Server's messages in ports marked with untrusted (all but those on the DHCP server).