DHCP Pool Exhaustion via Centralized ARP Reachability
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Conventional methods to prevent DHCP exhaustion and starvation in Wi-Fi networks, such as increasing DHCP pool size or lowering lease time, are inefficient and prone to security attacks, and ICMP PING reachability tests are often blocked by firewalls, leading to IP address shortages and security vulnerabilities.
Innovation Solution
Implementing a system that uses centralized ARP messages to detect available IP addresses by bypassing firewall blocks through SDN capabilities, where an SDN server collects a neighbor table and triggers ARP requests to determine IP address usage, allowing unused addresses to be returned to the pool.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If ICMP PING is used to test client reachability, then IP address reuse can be identified, but firewall blocks prevent the test from working reliably
Solution Approach 1:
The patent introduces an intermediary ARP-based reachability test mechanism that operates at the data link layer (Layer 2) rather than the network layer (Layer 3). The DHCP server sends ARP requests to test if an IP address is currently in use, bypassing firewall rules that block ICMP echo requests. This intermediary approach allows reliable IP address status detection without being blocked by firewall configurations.
2Quantity of substance
If DHCP pool size is increased to prevent exhaustion, then more IP addresses are available, but network IP addresses are wasted
Solution Approach 1:
The patent implements dynamic IP address management by continuously monitoring IP address usage status through ARP-based reachability tests. Instead of statically allocating a large DHCP pool, the system dynamically identifies and reclaims IP addresses that are no longer in use but were previously leased. This dynamic approach allows the DHCP server to maintain a smaller pool while ensuring adequate availability, as addresses are reused promptly when freed.
Solution Approach 2:
The system establishes a feedback mechanism where the DHCP server periodically tests IP address reachability using ARP requests and receives feedback about actual usage status. Based on this feedback, the server intelligently reclaims addresses from the DHCP pool when they are determined to be unused, even before lease expiration. This feedback-driven management optimizes the balance between address availability and pool size.
3Quantity of substance
If DHCP lease time is lowered to prevent exhaustion, then IP addresses are freed faster, but DHCP renewal packet exchange increases exponentially
Solution Approach 1:
The patent implements preliminary action by performing ARP-based reachability tests before lease expiration to proactively identify IP addresses that are no longer in use. Instead of waiting for leases to expire naturally (which would trigger renewal traffic), the system提前 detects unused addresses and reclaims them to the DHCP pool. This preliminary detection and reclamation reduces the need for frequent lease renewals and associated packet exchanges.
4Quantity of substance
If conventional DHCP exhaustion prevention methods are used, then IP availability improves, but security vulnerabilities to DHCP starvation attacks increase
Solution Approach 1:
The patent introduces an intermediary ARP-based verification mechanism that acts as a security layer between the DHCP server and client devices. Before allocating an IP address, the server sends an ARP request to verify the address is not already in use. This intermediary check prevents DHCP starvation attacks where malicious clients send fake DHCP requests to exhaust the pool, as the ARP verification ensures addresses are genuinely available before allocation.
Data Source
AI summary
A low number of available Internet Protocol (IP) addresses is detected in an IP pool that available for lease from the Dynamic Host Configuration Protocol (DHCP) server. A neighbor table from a gateway device behind a firewall that blocks Internet Control Message Protocol (ICMP) echo requests from the DHCP server. The gateway device is triggered to broadcast an Address Resolution Protocol (ARP) request to network devices of the neighbor table behind the firewall to determine whether a specific IP address is in use. Responsive to an ARP response not being received, the control module releasing a lease for the specific IP thereby returning to the IP pool available for lease in the DHCP server.