DHCP Starvation Attacks: Network+ Security Deep Dive

A DHCP starvation attack occurs when an attacker floods a DHCP server with forged DHCPDISCOVER packets using spoofed MAC addresses. This exhausts the server's available IP address pool, preventing legitimate clients from obtaining addresses and often paving the way for a rogue DHCP server to take over the network.

What exactly is a DHCP Starvation attack?

To understand starvation, you first have to remember the DORA process (Discover, Offer, Request, Acknowledge). In a healthy network, a client broadcasts a DHCPDISCOVER packet, and the server responds with an available IP from its defined scope. However, a DHCP server only has a finite number of addresses to give out—perhaps 254 for a standard /24 subnet.

In a starvation attack, the attacker uses a tool like Yersinia to flood the server with thousands of DHCPDISCOVER packets in a matter of seconds. Because the server is designed to be helpful, it attempts to offer an IP for every single request. Within moments, the entire pool of available addresses is exhausted, leaving legitimate users with an APIPA address (169.254.x.x) and zero network connectivity. For the Network+ exam, remember that this is essentially a Denial of Service (DoS) attack targeting the availability of network resources.

How do attackers use forged MAC addresses to trick the server?

You might wonder why the server doesn't just realize all these requests are coming from one computer. The secret lies in MAC spoofing. DHCP servers track which IP is assigned to which device based on the client's hardware (MAC) address. If an attacker sent 200 requests from a single MAC address, the server would simply renew the lease for that one device.

To bypass this, the attacker generates a unique, forged MAC address for every single DHCPDISCOVER packet they send. The server sees these as hundreds of different physical devices joining the network simultaneously. It dutifully assigns a unique IP to each fake MAC, filling the lease table until there is nothing left. This is a critical concept for the N10-009 objectives: the attack leverages the trust inherent in Layer 2 protocols to manipulate Layer 3 address assignment.

Why is starvation often paired with rogue DHCP servers?

A starvation attack is rarely the end goal; it's usually the setup for something more sinister. Once the legitimate DHCP server is 'starved' and unable to respond, the attacker introduces a Rogue DHCP Server into the environment. Since the official server is out of commission, any new device joining the network will accept the first DHCP Offer it receives—which now comes from the attacker.

By controlling the DHCP process, the attacker can assign themselves as the Default Gateway or the DNS Server for every client on the subnet. This creates a perfect Man-in-the-Middle (MitM) scenario. The attacker can now intercept, inspect, and modify all traffic leaving the subnet before forwarding it to the real gateway. If you see 'DHCP Starvation' and 'Rogue Server' mentioned together in a scenario, you're almost certainly looking at a MitM attack vector.

How do you implement DHCP Snooping to stop these attacks?

The gold standard for preventing this is DHCP Snooping. This is a Layer 2 security feature configured on your network switches. When you enable DHCP Snooping, the switch divides its ports into two categories: Trusted and Untrusted. You configure the port connected to your legitimate DHCP server as 'Trusted,' while all user-facing ports are 'Untrusted.'

If the switch sees a DHCP Offer or DHCP ACK packet coming from an untrusted port, it immediately drops the packet and logs a security violation. This prevents rogue servers from operating. To stop the starvation part specifically, DHCP Snooping can be paired with rate-limiting. By limiting the number of DHCP packets allowed per second on an untrusted port, you prevent a single attacker from flooding the server with thousands of requests, ensuring the IP pool remains available for real users.

What other defenses should you know for the Network+ exam?

Beyond snooping, you should be familiar with Port Security. By limiting the number of MAC addresses allowed on a single physical switch port (e.g., allowing only one or two MACs), you kill a starvation attack in its tracks. If an attacker tries to send requests with 100 different spoofed MACs, the switch will detect the violation and can either shut down the port or drop the offending traffic.

Another practical tip is to optimize your lease times. While very short leases can actually help recover a starved pool faster, they increase network overhead. In a high-security environment, combining Port Security with DHCP Snooping provides a multi-layered defense that protects both the availability of your IP pool and the integrity of your routing data.

How can you master these security concepts for the N10-009?

Understanding the theory of DHCP starvation is one thing, but applying it to complex exam scenarios is where most students struggle. You need to be able to distinguish between a simple DoS and a coordinated MitM attack based on the symptoms described in a question.

This is why we built Cert Sensei. We offer 1,000 expert-curated CompTIA Network+ (N10-009) practice questions that mirror the actual exam's difficulty. Instead of just telling you the right answer, we provide detailed expert reasoning for every single response, helping you understand the 'why' behind the security mechanism. Plus, our domain-level analytics track your performance in the 'Network Security' section, so you know exactly when you've mastered DHCP protections and when you need to hit the books again.

❓ Frequently Asked Questions