-: DHCP issues. 2 2
In this video, we're going to discuss DHCP issues, 3 3
such as rogue DHCP servers, and DHCP scope exhaustion. 4 4
Now DHCP, or the Dynamic Host Configuration Protocol 5 5
is a network management protocol that's used on IP networks 6 6
for automatically assigning IP addresses 7 7
and other communication parameters 8 8
to devices that are connected to the network 9 9
using a client server architecture. 10 10
Basically DHCP is used to automatically assign 11 11
an IP address, a subnet mask, a default gateway, 12 12
and a DNS server IP address to a client 13 13
whenever it joins the network. 14 14
This works great most of the time, 15 15
but if someone adds a rogue DHCP server to your network, 16 16
this can cause a ton of issues for you. 17 17
Now, a rogue DHCP server is a DHCP server on the network 18 18
that is not under your administrative control, 19 19
since you're the network administrator. 20 20
Remember rogue DHCP servers can be installed on the network 21 21
either as part of a malicious attack 22 22
or simply accidentally by your own employees. 23 23
In the case of a malicious attack, 24 24
the rogue DHCP server could be used 25 25
to automatically configure network clients 26 26
as they join the network to use a different DHCP server, 27 27
one that's controlled by your attacker. 28 28
That way, anytime somebody enters google.com 29 29
or citibank.com, they're going to be redirected to another site 30 30
that's controlled by the attacker 31 31
and looks like those sites, 32 32
and then they can conduct an on-path 33 33
or Man in the Middle attack against them. 34 34
Now, in the case of an accidental install by an employee, 35 35
this normally occurs when somebody connects 36 36
a wireless router or wireless gateway to your network 37 37
for their own convenience. 38 38
And they really didn't realize that the device 39 39
had a built in DHCP server contained within it. 40 40
In either case, the rogue DHCP server will begin to hand out 41 41
IP addresses from its own scope. 42 42
Now, this scope may or may not be the same 43 43
as your official DHCP servers. 44 44
If it isn't, you're not going to see 45 45
a lot of network connectivity issues for those clients 46 46
that are getting IPS from the rogue DHCP server, 47 47
if the default gateway is still being handed out correctly. 48 48
Now, if the rogue DHCP server's using the same scope 49 49
as your DHCP server, 50 50
this is where you can have a lot of problems. 51 51
For example, let's pretend you're both using 192.168.1.0/24 52 52
as your network scopes. 53 53
This is a traditional one used by small office 54 54
and home office networks. 55 55
You both then can start to suffer connectivity issues 56 56
because two devices can both be assigned 57 57
the exact same IP address, 58 58
leading to a duplicate IP address. 59 59
Now to prevent a rogue DHCP server from connecting 60 60
to your network, you should configure DHCP snooping 61 61
on your network. 62 62
DHCP snooping is a series of techniques that are applied 63 63
to improve the security of DHCPs infrastructure 64 64
by excluding rogue DHCP server traffic 65 65
and removing their malicious or malformed DHCP traffic 66 66
from the network. 67 67
Now rogue DHCP servers can also be countered 68 68
by using port security on your switch ports 69 69
because that rogue DHCP smack address 70 70
isn't going to be on your authorized list of devices 71 71
when they connect to a switch port. 72 72
Finally, rogue DHCP servers can also be detected 73 73
by properly configuring an intrusion detection system, 74 74
and once identified, 75 75
it can be manually removed from the network 76 76
by your network administrators. 77 77
Next we have DHCP scope exhaustion. 78 78
Now DHCP scope exhaustion occurs when the DHCP server 79 79
simply runs out of valid IPs to assign to somebody 80 80
when they join the network. 81 81
For example, let's say again, you're using the scope 82 82
of 192.168.1.0/24 and that's your private class C network. 83 83
You've reserved 192.168.1.1 for the gateway 84 84
and 192.168.1.255 for your broadcast. 85 85
Now you have 254 IPs left in your DHCP scope. 86 86
Now, as long as you have less than 254 devices 87 87
that want to connect to you at the same time, 88 88
you're not going to suffer DHCP scope exhaustion. 89 89
But if you have 500 people that want to connect, 90 90
you're going to run out of IP addresses 91 91
before everybody gets their own. 92 92
Now many DHCP servers use a default lease time 93 93
of 1440 seconds, which is one day, 94 94
but I've seen some organizations set their DHCP leases 95 95
to seven days or even 30 days. 96 96
Now this is helpful from a security analyst perspective 97 97
because those clients aren't changing their IP addresses 98 98
as often, and so it's easier to correlate log data, 99 99
but these longer lease times 100 100
can lead to DHCP scope exhaustion 101 101
if you have a lot of transient users. 102 102
For example, let's say you're running the wireless network 103 103
at a local college. 104 104
You have hundreds or thousands of different people 105 105
that connect your network on a daily basis. 106 106
One student might have a class on Monday, 107 107
Wednesday, and Friday, and another student 108 108
might have classes on Tuesday and Thursday. 109 109
If you're using seven day leases, 110 110
the first student would still have their lease 111 111
for the entire week, and so would the second student. 112 112
Now we're going to need two leases for these two students. 113 113
But if we instead lowered our lease time to 24 hours, 114 114
these two students could, in theory, 115 115
receive the exact same IP, 116 116
but not at the same time 117 117
because the lease would expire on the first one 118 118
before the second one showed up to class. 119 119
Now another thing you can do 120 120
to overcome DHCP scope exhaustion 121 121
is to increase the scope size. 122 122
For example, instead of providing the 254 IP addresses 123 123
by using the network of 192.168.1.0/24, 124 124
I can instead change my scope to 172.16.1.0/22. 125 125
This gives me 1022 available IPs 126 126
for me to assign to my clients, 127 127
which is going to serve all 500 of my students 128 128
with no problem. 129 129
The final thing you can do is decrease the number of devices 130 130
that are using the DHCP server, 131 131
and in turn the IP addresses from its scope. 132 132
In this case, you're going to want to enable port security 133 133
or network access control, NAC, 134 134
to enable you to prevent clients from accessing your network 135 135
and getting assigned an IP address from your DHCP scope.