DHCP starvation: every address taken

The idea

A DHCP server leases one address per MAC that asks, and cannot tell a real MAC from a forged one. DHCP starvation abuses that: an attacker claims every address in the pool under made-up MACs, so no device that relies on DHCP can join — a quiet denial of service. Only hosts whose address is set by hand ride it out.

Steps

1. A small pool, a healthy network

   The DHCP server leases from a small range — nine addresses. A genuine laptop joins, is handed one, and with it reaches a server out on the internet and the office printer, whose address was set by hand.

   newLaptop:~# udhcpc -i eth0 -n -q -t 4 -T 2
   newLaptop:~# curl -s -o /dev/null -w 'internet=%{http_code}\n' --max-time 5 http://10.0.2.10/
   newLaptop:~# curl -s --max-time 5 http://10.0.1.14/

2. The attacker drains the pool

   The attacker asks for a lease over and over, each time under a freshly forged MAC address. The server, seeing what looks like many new devices, leases one to each until it has none left. Listen on the server and watch the storm of requests from made-up MACs.

   newLaptop:~# udhcpc -i eth0 -n -q -t 4 -T 2