In this video,
we're going to discuss DHCP issues
such as rogue DHCP servers and DHCP scope exhaustion.
Now, DHCP or the Dynamic Host Configuration Protocol
is a network management protocol that's used on IP networks
automatically assigning IP addresses
and other communication parameters
to devices that are connected to the network
using a client-server architecture.
Basically, DHCP is used
to automatically assign an IP address, a subnet mask,
a default gateway, and a DNS server's IP address to a client
whenever it joins the network.
This works great most of the time,
but if someone has a rogue DHCP server to your network,
this can cause a ton of issues for you.
Now, a rogue DHCP server is a DHCP server on the network
that is not under your administrative control
since you are the network administrator.
Remember, rogue DHCP servers
can be installed on the network
either as part of a malicious attack
or simply accidentally by your own employees.
In the case of a malicious attack,
the rogue DHCP server could be used
to automatically configure network clients
as they join the network to use a different DHCP server,
one that's controlled by your attacker.
That way, anytime somebody enters google.com
or citibank.com,
they're going to be redirected to another site
that's controlled by the attacker
and looks like those sites,
and then they can conduct an on path
or man-in-the-middle attack against them.
Now, in the case of an accidental install by an employee,
this normally occurs
when somebody connects a wireless router
or wireless gateway to your network
for their own convenience,
and they really didn't realize
that the device had a built-in DHCP server
contained within it.
In either case, the rogue DHCP server
will begin to hand out IP addresses from its own scope.
Now, this scope may or may not be the same
as your official DHCP servers.
If it isn't,
you're not going to see a lot of network connectivity issues
for those clients
that are getting IPs from the rogue DHCP server
if the default gateway is still being handed out correctly.
Now, if the rogue DHCP server is using the same scope
as your DHCP server,
this is where you can have a lot of problems.
For example, let's pretend you're both using 192.168.1.0/24
as your network scopes.
This is a traditional one used by small office
and home office networks.
You both then can start to suffer connectivity issues
because two devices can both be assigned
the exact same IP address leading to a duplicate IP address.
Now, to prevent a rogue DHCP server
from connecting to your network,
you should configure DHCP snooping on your network.
DHCP snooping is a series of techniques
that are applied to improve the security
of DHCP's infrastructure
by excluding rogue DHCP server traffic
and removing their malicious
or malformed DHCP traffic from the network.
Now, rogue DHCP servers can also be countered
by using port security on your switch ports
because that rogue DHCP's MAC address isn't going to be
on your authorized list of devices
when they connect to a switch port.
Finally, rogue DHCP servers can also be detected
by properly configuring an intrusion detection system,
and once identified,
it can be manually removed from the network
by your network administrators.
Next, we have DHCP scope exhaustion.
Now, DHCP scope exhaustion occurs
when the DHCP server simply runs out of valid IPs
to assign to somebody when they join the network.
For example, let's say again,
you're using the scope of 192.168.1.0/24,
and that's your private class C network.
You've reserved 192.168.1.1 for the gateway
and 192.168.1.255 for your broadcast.
Now, you have 254 IPs left in your DHCP scope.
Now, as long as you have less than 254 devices
that want to connect you at the same time,
you're not going to suffer DHCP scope exhaustion.
But if you have 500 people that want to connect,
you're going to run out IP addresses
before everybody gets their own.
Now, many DHCP servers use a default lease time
of 86,400 seconds, which is one day,
but I've seen some organizations set their DHCP leases
to seven days or even 30 days.
Now, this is helpful from a security analyst perspective
because those clients
aren't changing their IP addresses as often
and so it's easier to correlate log data,
but these longer lease times
can lead to DHCP scope exhaustion
if you have a lot of transient users.
For example, let's say you're running
the wireless network at a local college.
You have hundreds or thousands of different people
that connect to your network on a daily basis.
One student might have a class
on Monday, Wednesday, and Friday,
and another student might have classes
on Tuesday and Thursday.
If you're using seven-day leases,
the first student would still have their lease
for the entire week,
and so with the second student.
Now, we're going to need two leases for these two students.
But if we instead lowered our lease time to 24 hours,
these two students could,
in theory, receive the exact same IP,
but not at the same time
because the lease would expire on the first one
before the second one showed up to class.
Now, another thing you can do
to overcome DHCP scope exhaustion
is to increase the scope size.
For example, instead of providing the 254 IP addresses
by using the network of 192.168.1.0/24,
I can instead change my scope to 172.16.1.0/22.
This gives me 1,022 available IPs
for me to assign to my clients,
which is going to serve all 500 of my students with no problem.
The final thing you can do is decrease the number of devices
that are using the DHCP server
and in turn, the IP addresses from its scope.
In this case, you're going to want to enable port security
or network access control, NAC,
to enable you to prevent clients from accessing your network
and getting assigned an IP address from your DHCP scope.