HP 6125G HP 6125G & 6125G/XG Blade Switches Layer 3 - IP Services Conf - Page 64

Enabling DHCP-REQUEST message attack protection, Displaying and maintaining DHCP snooping

Get HP 6125G PDF manuals and user guides View all HP 6125G manuals
Add to My Manuals
Save this manual to your list of manuals

Page 64 highlights

Enabling DHCP-REQUEST message attack protection Attackers may forge DHCP-REQUEST messages to renew the IP address leases for legitimate DHCP clients that no longer need the IP addresses. These forged messages keep a victim DHCP server renewing the leases of IP addresses instead of releasing the IP addresses. This wastes IP address resources. To prevent such attacks, you can enable DHCP-REQUEST message check on DHCP snooping devices. With this feature enabled, upon receiving a DHCP-REQUEST message, a DHCP snooping device looks up local DHCP snooping entries for the corresponding entry of the message. If an entry is found, the DHCP snooping device compares the entry with the message information. If they are consistent, the DHCP-REQUEST message is considered a valid lease renewal request and forwarded to the DHCP server. If they are not consistent, the message is considered a forged lease renewal request and discarded. If no corresponding entry is found, the message is considered valid and forwarded to the DHCP server. Enable DHCP-REQUEST message check only on Layer 2 Ethernet ports, and Layer 2 aggregate interfaces. To enable DHCP-REQUEST message check: Step 1. Enter system view. 2. Enter interface view. 3. Enable DHCP-REQUEST message check. Command system-view interface interface-type interface-number Remarks N/A N/A dhcp-snooping check request-message Disabled by default Displaying and maintaining DHCP snooping Task Display DHCP snooping entries. Display Option 82 configuration information on the DHCP snooping device. Display DHCP packet statistics on the DHCP snooping device. Display information about trusted ports. Display the DHCP snooping entry file information. Clear DHCP snooping entries. Command Remarks display dhcp-snooping [ ip ip-address ] [ | { begin | exclude | include } regular-expression ] Available in any view display dhcp-snooping information { all | interface interface-type interface-number } [ | { begin | exclude | include } regular-expression ] Available in any view display dhcp-snooping packet statistics [ slot slot-number ] [ | { begin | exclude | Available in any view include } regular-expression ] display dhcp-snooping trust [ | { begin | exclude | include } regular-expression ] Available in any view display dhcp-snooping binding database [ | { begin | exclude | include } Available in any view regular-expression ] reset dhcp-snooping { all | ip ip-address } Available in user view 56

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
56
Enabling DHCP-REQUEST message attack
protection
Attackers may forge DHCP-REQUEST messages to renew the IP address leases for legitimate DHCP
clients that no longer need the IP addresses. These forged messages keep a victim DHCP server renewing
the leases of IP addresses instead of releasing the IP addresses. This wastes IP address resources.
To prevent such attacks, you can enable DHCP-REQUEST message check on DHCP snooping devices.
With this feature enabled, upon receiving a DHCP-REQUEST message, a DHCP snooping device looks
up local DHCP snooping entries for the corresponding entry of the message. If an entry is found, the
DHCP snooping device compares the entry with the message information. If they are consistent, the
DHCP-REQUEST message is considered a valid lease renewal request and forwarded to the DHCP server.
If they are not consistent, the message is considered a forged lease renewal request and discarded. If no
corresponding entry is found, the message is considered valid and forwarded to the DHCP server.
Enable DHCP-REQUEST message check only on Layer 2 Ethernet ports, and Layer 2 aggregate
interfaces.
To enable DHCP-REQUEST message check:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter interface view.
interface
interface-type interface-number
N/A
3.
Enable DHCP-REQUEST message
check.
dhcp-snooping check request-message
Disabled by default
Displaying and maintaining DHCP snooping
Task
Command
Remarks
Display DHCP snooping entries.
display dhcp-snooping
[
ip
ip-address
]
[
|
{
begin
|
exclude
|
include
}
regular-expression
]
Available in any view
Display Option 82 configuration
information on the DHCP snooping
device.
display dhcp-snooping information
{
all
|
interface
interface-type
interface-number
} [
|
{
begin
|
exclude
|
include
}
regular-expression
]
Available in any view
Display DHCP packet statistics on the
DHCP snooping device.
display dhcp-snooping packet statistics
[
slot
slot-number
] [
|
{
begin
|
exclude
|
include
}
regular-expression
]
Available in any view
Display information about trusted ports.
display dhcp-snooping trust
[
|
{
begin
|
exclude
|
include
}
regular-expression
]
Available in any view
Display the DHCP snooping entry file
information.
display dhcp-snooping binding database
[
|
{
begin
|
exclude
|
include
}
regular-expression
]
Available in any view
Clear DHCP snooping entries.
reset dhcp-snooping
{
all
|
ip
ip-address
}
Available in user view