HP 6125XLG R2306-HP 6125XLG Blade Switch Layer 3 - IP Services Configuration G - Page 78

Enabling DHCP starvation attack protection, Enabling DHCP-REQUEST attack protection

Get HP 6125XLG PDF manuals and user guides View all HP 6125XLG manuals
Add to My Manuals
Save this manual to your list of manuals

Page 78 highlights

Step 4. (Optional.) Set the amount of time to wait after a DHCP snooping entry changes before updating the database file. Command dhcp snooping binding database update interval seconds Remarks The default interval is 300 seconds. Enabling DHCP starvation attack protection A DHCP starvation attack occurs when an attacker constantly sends forged DHCP requests that contain identical or different sender MAC addresses in the chaddr field to a DHCP server. This attack exhausts the IP address resources of the DHCP server so legitimate DHCP clients cannot obtain IP addresses. The DHCP server might also fail to work because of exhaustion of system resources. For information about the fields of DHCP packet, see "DHCP message format." Protect against starvation attacks in the following ways: • To relieve a DHCP starvation attack that uses DHCP requests encapsulated with different sender MAC addresses, you can limit the number of MAC addresses that a Layer 2 port can learn by using the mac-address max-mac-count command. For more information about the command, see Layer 2-LAN Switching Command Reference. • To prevent a DHCP starvation attack that uses DHCP requests encapsulated with the same sender MAC address, perform this task to enable MAC address check for DHCP snooping. This function compares the chaddr field of a received DHCP request with the source MAC address field in the frame header. If they are the same, the request is considered valid and forwarded to the DHCP server. If not, the request is discarded. To enable MAC address check: Step 1. Enter system view. 2. Enter interface view. 3. Enable MAC address check. Command system-view interface interface-type interface-number dhcp snooping check mac-address Remarks N/A N/A By default, MAC address check is disabled. Enabling DHCP-REQUEST attack protection DHCP-REQUEST messages include DHCP lease renewal packets, DHCP-DECLINE packets, and DHCP-RELEASE packets. This function prevents the unauthorized clients that forge the DHCP-REQUEST messages from attacking the DHCP server. Attackers can forge DHCP lease renewal packets to renew leases for legitimate DHCP clients that no longer need the IP addresses. These forged messages disable the victim DHCP server from releasing the IP addresses. Attackers can also forge DHCP-DECLINE or DHCP-RELEASE packets to terminate leases for legitimate DHCP clients that still need the IP addresses. To prevent such attacks, you can enable DHCP-REQUEST check. This feature uses DHCP snooping entries to check incoming DHCP-REQUEST messages. If a matching entry is found for a message, this feature 69

  • 1
  • 2
  • 3
  • 4
  • 5
  • 6
  • 7
  • 8
  • 9
  • 10
  • 11
  • 12
  • 13
  • 14
  • 15
  • 16
  • 17
  • 18
  • 19
  • 20
  • 21
  • 22
  • 23
  • 24
  • 25
  • 26
  • 27
  • 28
  • 29
  • 30
  • 31
  • 32
  • 33
  • 34
  • 35
  • 36
  • 37
  • 38
  • 39
  • 40
  • 41
  • 42
  • 43
  • 44
  • 45
  • 46
  • 47
  • 48
  • 49
  • 50
  • 51
  • 52
  • 53
  • 54
  • 55
  • 56
  • 57
  • 58
  • 59
  • 60
  • 61
  • 62
  • 63
  • 64
  • 65
  • 66
  • 67
  • 68
  • 69
  • 70
  • 71
  • 72
  • 73
  • 74
  • 75
  • 76
  • 77
  • 78
  • 79
  • 80
  • 81
  • 82
  • 83
  • 84
  • 85
  • 86
  • 87
  • 88
  • 89
  • 90
  • 91
  • 92
  • 93
  • 94
  • 95
  • 96
  • 97
  • 98
  • 99
  • 100
  • 101
  • 102
  • 103
  • 104
  • 105
  • 106
  • 107
  • 108
  • 109
  • 110
  • 111
  • 112
  • 113
  • 114
  • 115
  • 116
  • 117
  • 118
  • 119
  • 120
  • 121
  • 122
  • 123
  • 124
  • 125
  • 126
  • 127
  • 128
  • 129
  • 130
  • 131
  • 132
  • 133
  • 134
  • 135
  • 136
  • 137
  • 138
  • 139
  • 140
  • 141
  • 142
  • 143
  • 144
  • 145
  • 146
  • 147
  • 148
  • 149
  • 150
  • 151
  • 152
  • 153
  • 154
  • 155
  • 156
  • 157
  • 158
  • 159
  • 160
  • 161
  • 162
  • 163
  • 164
  • 165
  • 166
  • 167
  • 168
  • 169
  • 170
  • 171
  • 172
  • 173
  • 174
  • 175
  • 176
  • 177
  • 178
  • 179
  • 180
  • 181
  • 182
  • 183
  • 184
  • 185
  • 186
  • 187
  • 188
  • 189
  • 190
  • 191
  • 192
  • 193
  • 194
  • 195
  • 196
  • 197
  • 198
  • 199
  • 200
  • 201
  • 202
  • 203
  • 204
  • 205
  • 206
  • 207
  • 208
  • 209
  • 210
  • 211
  • 212
  • 213
  • 214
  • 215
  • 216
  • 217
  • 218
  • 219
  • 220
  • 221
  • 222
  • 223
  • 224
  • 225
  • 226
  • 227
  • 228
  • 229
  • 230
69
Step
Command
Remarks
4.
(Optional.) Set the amount of
time to wait after a DHCP
snooping entry changes
before updating the database
file.
dhcp snooping binding database
update interval
seconds
The default interval is 300 seconds.
Enabling DHCP starvation attack protection
A DHCP starvation attack occurs when an attacker constantly sends forged DHCP requests that contain
identical or different sender MAC addresses in the chaddr field to a DHCP server. This attack exhausts
the IP address resources of the DHCP server so legitimate DHCP clients cannot obtain IP addresses. The
DHCP server might also fail to work because of exhaustion of system resources. For information about the
fields of DHCP packet, see "
DHCP message format
."
Protect against starvation attacks in the following ways:
•
To relieve a DHCP starvation attack that uses DHCP requests encapsulated with different sender
MAC addresses, you can limit the number of MAC addresses that a Layer 2 port can learn by using
the
mac-address max-mac-count
command. For more information about the command, see
Layer
2—LAN Switching Command Reference
.
•
To prevent a DHCP starvation attack that uses DHCP requests encapsulated with the same sender
MAC address, perform this task to enable MAC address check for DHCP snooping. This function
compares the chaddr field of a received DHCP request with the source MAC address field in the
frame header. If they are the same, the request is considered valid and forwarded to the DHCP
server. If not, the request is discarded.
To enable MAC address check:
Step
Command
Remarks
1.
Enter system view.
system-view
N/A
2.
Enter interface view.
interface
interface-type interface-number
N/A
3.
Enable MAC address check.
dhcp snooping check mac-address
By default, MAC address
check is disabled.
Enabling DHCP-REQUEST attack protection
DHCP-REQUEST messages include DHCP lease renewal packets, DHCP-DECLINE packets, and
DHCP-RELEASE packets. This function prevents the unauthorized clients that forge the DHCP-REQUEST
messages from attacking the DHCP server.
Attackers can forge DHCP lease renewal packets to renew leases for legitimate DHCP clients that no
longer need the IP addresses. These forged messages disable the victim DHCP server from releasing the
IP addresses.
Attackers can also forge DHCP-DECLINE or DHCP-RELEASE packets to terminate leases for legitimate
DHCP clients that still need the IP addresses.
To prevent such attacks, you can enable DHCP-REQUEST check. This feature uses DHCP snooping entries
to check incoming DHCP-REQUEST messages. If a matching entry is found for a message, this feature