1 1 00:00:00,490 --> 00:00:02,270 DHCP issues. 2 2 00:00:02,270 --> 00:00:05,150 In this video, we're going to discuss DHCP issues, 3 3 00:00:05,150 --> 00:00:09,110 such as rogue DHCP servers, and DHCP scope exhaustion. 4 4 00:00:09,110 --> 00:00:12,530 Now DHCP, or the Dynamic Host Configuration Protocol 5 5 00:00:12,530 --> 00:00:15,380 is a network management protocol that's used on IP networks 6 6 00:00:15,380 --> 00:00:17,470 for automatically assigning IP addresses 7 7 00:00:17,470 --> 00:00:19,130 and other communication parameters 8 8 00:00:19,130 --> 00:00:21,080 to devices that are connected to the network 9 9 00:00:21,080 --> 00:00:23,280 using a client server architecture. 10 10 00:00:23,280 --> 00:00:25,930 Basically DHCP is used to automatically assign 11 11 00:00:25,930 --> 00:00:28,910 an IP address, a subnet mask, a default gateway, 12 12 00:00:28,910 --> 00:00:31,410 and a DNS server IP address to a client 13 13 00:00:31,410 --> 00:00:33,040 whenever it joins the network. 14 14 00:00:33,040 --> 00:00:34,960 This works great most of the time, 15 15 00:00:34,960 --> 00:00:37,860 but if someone adds a rogue DHCP server to your network, 16 16 00:00:37,860 --> 00:00:40,450 this can cause a ton of issues for you. 17 17 00:00:40,450 --> 00:00:44,090 Now, a rogue DHCP server is a DHCP server on the network 18 18 00:00:44,090 --> 00:00:46,230 that is not under your administrative control, 19 19 00:00:46,230 --> 00:00:48,150 since you're the network administrator. 20 20 00:00:48,150 --> 00:00:51,340 Remember rogue DHCP servers can be installed on the network 21 21 00:00:51,340 --> 00:00:53,100 either as part of a malicious attack 22 22 00:00:53,100 --> 00:00:56,210 or simply accidentally by your own employees. 23 23 00:00:56,210 --> 00:00:57,910 In the case of a malicious attack, 24 24 00:00:57,910 --> 00:00:59,800 the rogue DHCP server could be used 25 25 00:00:59,800 --> 00:01:01,760 to automatically configure network clients 26 26 00:01:01,760 --> 00:01:04,940 as they join the network to use a different DHCP server, 27 27 00:01:04,940 --> 00:01:06,900 one that's controlled by your attacker. 28 28 00:01:06,900 --> 00:01:09,420 That way, anytime somebody enters google.com 29 29 00:01:09,420 --> 00:01:12,800 or citibank.com, they're going to be redirected to another site 30 30 00:01:12,800 --> 00:01:14,150 that's controlled by the attacker 31 31 00:01:14,150 --> 00:01:15,580 and looks like those sites, 32 32 00:01:15,580 --> 00:01:17,570 and then they can conduct an on-path 33 33 00:01:17,570 --> 00:01:19,690 or Man in the Middle attack against them. 34 34 00:01:19,690 --> 00:01:22,700 Now, in the case of an accidental install by an employee, 35 35 00:01:22,700 --> 00:01:24,570 this normally occurs when somebody connects 36 36 00:01:24,570 --> 00:01:27,400 a wireless router or wireless gateway to your network 37 37 00:01:27,400 --> 00:01:28,640 for their own convenience. 38 38 00:01:28,640 --> 00:01:30,180 And they really didn't realize that the device 39 39 00:01:30,180 --> 00:01:33,250 had a built in DHCP server contained within it. 40 40 00:01:33,250 --> 00:01:36,430 In either case, the rogue DHCP server will begin to hand out 41 41 00:01:36,430 --> 00:01:38,780 IP addresses from its own scope. 42 42 00:01:38,780 --> 00:01:40,920 Now, this scope may or may not be the same 43 43 00:01:40,920 --> 00:01:42,960 as your official DHCP servers. 44 44 00:01:42,960 --> 00:01:44,380 If it isn't, you're not going to see 45 45 00:01:44,380 --> 00:01:46,770 a lot of network connectivity issues for those clients 46 46 00:01:46,770 --> 00:01:49,200 that are getting IPS from the rogue DHCP server, 47 47 00:01:49,200 --> 00:01:52,220 if the default gateway is still being handed out correctly. 48 48 00:01:52,220 --> 00:01:54,870 Now, if the rogue DHCP server's using the same scope 49 49 00:01:54,870 --> 00:01:56,330 as your DHCP server, 50 50 00:01:56,330 --> 00:01:58,580 this is where you can have a lot of problems. 51 51 00:01:58,580 --> 00:02:03,117 For example, let's pretend you're both using 192.168.1.0/24 52 52 00:02:04,220 --> 00:02:05,430 as your network scopes. 53 53 00:02:05,430 --> 00:02:07,620 This is a traditional one used by small office 54 54 00:02:07,620 --> 00:02:09,160 and home office networks. 55 55 00:02:09,160 --> 00:02:11,940 You both then can start to suffer connectivity issues 56 56 00:02:11,940 --> 00:02:13,860 because two devices can both be assigned 57 57 00:02:13,860 --> 00:02:15,500 the exact same IP address, 58 58 00:02:15,500 --> 00:02:17,820 leading to a duplicate IP address. 59 59 00:02:17,820 --> 00:02:20,210 Now to prevent a rogue DHCP server from connecting 60 60 00:02:20,210 --> 00:02:22,860 to your network, you should configure DHCP snooping 61 61 00:02:22,860 --> 00:02:24,050 on your network. 62 62 00:02:24,050 --> 00:02:27,070 DHCP snooping is a series of techniques that are applied 63 63 00:02:27,070 --> 00:02:29,730 to improve the security of DHCPs infrastructure 64 64 00:02:29,730 --> 00:02:32,060 by excluding rogue DHCP server traffic 65 65 00:02:32,060 --> 00:02:35,140 and removing their malicious or malformed DHCP traffic 66 66 00:02:35,140 --> 00:02:36,460 from the network. 67 67 00:02:36,460 --> 00:02:38,920 Now rogue DHCP servers can also be countered 68 68 00:02:38,920 --> 00:02:41,170 by using port security on your switch ports 69 69 00:02:41,170 --> 00:02:43,330 because that rogue DHCP smack address 70 70 00:02:43,330 --> 00:02:45,510 isn't going to be on your authorized list of devices 71 71 00:02:45,510 --> 00:02:47,320 when they connect to a switch port. 72 72 00:02:47,320 --> 00:02:50,340 Finally, rogue DHCP servers can also be detected 73 73 00:02:50,340 --> 00:02:52,930 by properly configuring an intrusion detection system, 74 74 00:02:52,930 --> 00:02:54,210 and once identified, 75 75 00:02:54,210 --> 00:02:56,220 it can be manually removed from the network 76 76 00:02:56,220 --> 00:02:58,200 by your network administrators. 77 77 00:02:58,200 --> 00:03:01,130 Next we have DHCP scope exhaustion. 78 78 00:03:01,130 --> 00:03:04,840 Now DHCP scope exhaustion occurs when the DHCP server 79 79 00:03:04,840 --> 00:03:07,560 simply runs out of valid IPs to assign to somebody 80 80 00:03:07,560 --> 00:03:09,000 when they join the network. 81 81 00:03:09,000 --> 00:03:11,390 For example, let's say again, you're using the scope 82 82 00:03:11,390 --> 00:03:16,390 of 192.168.1.0/24 and that's your private class C network. 83 83 00:03:17,460 --> 00:03:21,220 You've reserved 192.168.1.1 for the gateway 84 84 00:03:21,220 --> 00:03:25,170 and 192.168.1.255 for your broadcast. 85 85 00:03:25,170 --> 00:03:29,270 Now you have 254 IPs left in your DHCP scope. 86 86 00:03:29,270 --> 00:03:31,980 Now, as long as you have less than 254 devices 87 87 00:03:31,980 --> 00:03:33,620 that want to connect to you at the same time, 88 88 00:03:33,620 --> 00:03:36,410 you're not going to suffer DHCP scope exhaustion. 89 89 00:03:36,410 --> 00:03:39,100 But if you have 500 people that want to connect, 90 90 00:03:39,100 --> 00:03:40,630 you're going to run out of IP addresses 91 91 00:03:40,630 --> 00:03:42,640 before everybody gets their own. 92 92 00:03:42,640 --> 00:03:45,940 Now many DHCP servers use a default lease time 93 93 00:03:45,940 --> 00:03:49,020 of 1440 seconds, which is one day, 94 94 00:03:49,020 --> 00:03:52,010 but I've seen some organizations set their DHCP leases 95 95 00:03:52,010 --> 00:03:54,240 to seven days or even 30 days. 96 96 00:03:54,240 --> 00:03:56,730 Now this is helpful from a security analyst perspective 97 97 00:03:56,730 --> 00:03:58,940 because those clients aren't changing their IP addresses 98 98 00:03:58,940 --> 00:04:01,630 as often, and so it's easier to correlate log data, 99 99 00:04:01,630 --> 00:04:03,440 but these longer lease times 100 100 00:04:03,440 --> 00:04:05,670 can lead to DHCP scope exhaustion 101 101 00:04:05,670 --> 00:04:07,890 if you have a lot of transient users. 102 102 00:04:07,890 --> 00:04:10,220 For example, let's say you're running the wireless network 103 103 00:04:10,220 --> 00:04:11,340 at a local college. 104 104 00:04:11,340 --> 00:04:13,520 You have hundreds or thousands of different people 105 105 00:04:13,520 --> 00:04:15,930 that connect your network on a daily basis. 106 106 00:04:15,930 --> 00:04:17,750 One student might have a class on Monday, 107 107 00:04:17,750 --> 00:04:19,700 Wednesday, and Friday, and another student 108 108 00:04:19,700 --> 00:04:21,710 might have classes on Tuesday and Thursday. 109 109 00:04:21,710 --> 00:04:23,440 If you're using seven day leases, 110 110 00:04:23,440 --> 00:04:25,160 the first student would still have their lease 111 111 00:04:25,160 --> 00:04:27,890 for the entire week, and so would the second student. 112 112 00:04:27,890 --> 00:04:31,060 Now we're going to need two leases for these two students. 113 113 00:04:31,060 --> 00:04:34,100 But if we instead lowered our lease time to 24 hours, 114 114 00:04:34,100 --> 00:04:36,050 these two students could, in theory, 115 115 00:04:36,050 --> 00:04:37,680 receive the exact same IP, 116 116 00:04:37,680 --> 00:04:39,260 but not at the same time 117 117 00:04:39,260 --> 00:04:41,370 because the lease would expire on the first one 118 118 00:04:41,370 --> 00:04:43,510 before the second one showed up to class. 119 119 00:04:43,510 --> 00:04:44,610 Now another thing you can do 120 120 00:04:44,610 --> 00:04:46,700 to overcome DHCP scope exhaustion 121 121 00:04:46,700 --> 00:04:48,770 is to increase the scope size. 122 122 00:04:48,770 --> 00:04:52,450 For example, instead of providing the 254 IP addresses 123 123 00:04:52,450 --> 00:04:57,290 by using the network of 192.168.1.0/24, 124 124 00:04:57,290 --> 00:05:02,290 I can instead change my scope to 172.16.1.0/22. 125 125 00:05:02,950 --> 00:05:05,720 This gives me 1022 available IPs 126 126 00:05:05,720 --> 00:05:07,240 for me to assign to my clients, 127 127 00:05:07,240 --> 00:05:09,080 which is going to serve all 500 of my students 128 128 00:05:09,080 --> 00:05:10,460 with no problem. 129 129 00:05:10,460 --> 00:05:13,010 The final thing you can do is decrease the number of devices 130 130 00:05:13,010 --> 00:05:14,690 that are using the DHCP server, 131 131 00:05:14,690 --> 00:05:17,500 and in turn the IP addresses from its scope. 132 132 00:05:17,500 --> 00:05:20,080 In this case, you're going to want to enable port security 133 133 00:05:20,080 --> 00:05:22,260 or network access control, NAC, 134 134 00:05:22,260 --> 00:05:24,950 to enable you to prevent clients from accessing your network 135 135 00:05:24,950 --> 00:05:28,023 and getting assigned an IP address from your DHCP scope.