HP 6125G HP 6125G & 6125G/XG Blade Switches Layer 3 - IP Services Conf - Page 63

Enabling DHCP starvation attack protection

Get HP 6125G PDF manuals and user guides View all HP 6125G manuals
Add to My Manuals
Save this manual to your list of manuals

Page 63 highlights

To configure DHCP snooping entries backup: Step 1. Enter system view. Command system-view 2. Specify the name of the file for storing DHCP snooping dhcp-snooping binding entries. database filename filename 3. Back up DHCP snooping entries to the file. dhcp-snooping binding database update now 4. Set the interval at which the DHCP snooping entry file is refreshed. dhcp-snooping binding database update interval minutes Remarks N/A Not specified by default. DHCP snooping entries are stored immediately after this command is used and then updated at the interval set by the dhcp-snooping binding database update interval command. Optional. DHCP snooping entries will be stored to the file each time this command is used. Optional. By default, the file is not refreshed periodically. Enabling DHCP starvation attack protection A DHCP starvation attack occurs when an attacker constantly sends forged DHCP requests using different MAC addresses in the chaddr field to a DHCP server. This exhausts the IP address resources of the DHCP server so legitimate DHCP clients cannot obtain IP addresses. The DHCP server may also fail to work because of exhaustion of system resources. You can protect against starvation attacks in the following ways: • To relieve a DHCP starvation attack that uses DHCP packets encapsulated with different source MAC addresses, you can limit the number of MAC addresses that a Layer 2 port can learn. • To prevent a DHCP starvation attack that uses DHCP requests encapsulated with the same source MAC address, enable MAC address check on the DHCP snooping device. With this function enabled, the DHCP snooping device compares the chaddr field of a received DHCP request with the source MAC address field of the frame. If they are the same, the request is considered valid and forwarded to the DHCP server. If not, the request is discarded. Enable MAC address check only on Layer 2 Ethernet ports and Layer 2 aggregate interfaces. To enable MAC address check: Step 1. Enter system view. 2. Enter interface view. 3. Enable MAC address check. Command system-view interface interface-type interface-number dhcp-snooping check mac-address Remarks N/A N/A Disabled by default 55

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
55
To configure DHCP snooping entries backup:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Specify the name of the file for
storing DHCP snooping
entries.
dhcp-snooping binding
database filename
filename
Not specified by default.
DHCP snooping entries are stored
immediately after this command is
used and then updated at the
interval set by the
dhcp-snooping
binding database update interval
command.
3.
Back up DHCP snooping
entries to the file.
dhcp-snooping binding
database update now
Optional.
DHCP snooping entries will be
stored to the file each time this
command is used.
4.
Set the interval at which the
DHCP snooping entry file is
refreshed.
dhcp-snooping binding
database update interval
minutes
Optional.
By default, the file is not refreshed
periodically.
Enabling DHCP starvation attack protection
A DHCP starvation attack occurs when an attacker constantly sends forged DHCP requests using
different MAC addresses in the chaddr field to a DHCP server. This exhausts the IP address resources of
the DHCP server so legitimate DHCP clients cannot obtain IP addresses. The DHCP server may also fail
to work because of exhaustion of system resources. You can protect against starvation attacks in the
following ways:
•
To relieve a DHCP starvation attack that uses DHCP packets encapsulated with different source
MAC addresses, you can limit the number of MAC addresses that a Layer 2 port can learn.
•
To prevent a DHCP starvation attack that uses DHCP requests encapsulated with the same source
MAC address, enable MAC address check on the DHCP snooping device. With this function
enabled, the DHCP snooping device compares the chaddr field of a received DHCP request with
the source MAC address field of the frame. If they are the same, the request is considered valid and
forwarded to the DHCP server. If not, the request is discarded.
Enable MAC address check only on Layer 2 Ethernet ports and Layer 2 aggregate interfaces.
To enable MAC address check:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter interface view.
interface
interface-type
interface-number
N/A
3.
Enable MAC address check.
dhcp-snooping check mac-address
Disabled by default