DHCP Relay Device Defending Against IP Pool Exhaustion
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
DHCP servers are vulnerable to attacks where malicious clients spoof multiple MAC addresses, exhausting IP address pools and denying legitimate clients access to the network due to the simple trust mode of IP address allocation.
Innovation Solution
A method and device that monitor packet traffic from client terminals, identifying IP addresses generating no traffic and restricting DHCP services if a threshold is exceeded, thereby identifying and mitigating potential attack risks by preventing further IP address allocation to malicious clients.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If DHCP server adopts simple trust mode for IP address allocation, then ease of operation is improved, but security is worsened making the server highly susceptible to attacks
Solution Approach 1:
The DHCP relay device monitors packet traffic from clients and provides feedback about their actual usage. When a client is allocated multiple IP addresses but generates no packet traffic, the system identifies this anomaly and restricts further DHCP services to that client, thereby resolving the contradiction between simple allocation and security monitoring
Solution Approach 2:
The system performs preliminary monitoring of packet traffic before fully trusting the DHCP allocation process. By checking whether allocated IP addresses are actually used for network communication, the system prevents malicious clients from exhausting the IP address pool while maintaining normal operation for legitimate clients
2Productivity
If DHCP server allocates IP addresses to any client terminal, then productivity is improved, but loss of substance occurs when IP address pool is exhausted by malicious clients
Solution Approach 1:
The system continuously monitors packet traffic feedback from clients to determine whether allocated IP addresses are actually used. When feedback shows no packet traffic for allocated addresses, the system identifies malicious behavior and restricts further allocations, preventing IP address pool exhaustion while maintaining productivity for legitimate clients
Solution Approach 2:
The system converts the harmful effect of malicious clients attempting to exhaust the IP pool into a beneficial security feature. By monitoring packet traffic and identifying clients with no actual usage, the system transforms what would be pure loss into a mechanism for detecting and preventing attacks, thereby protecting the IP address pool
3Reliability
If DHCP relay device monitors packet traffic and restricts DHCP service, then security is improved, but device complexity increases
Solution Approach 1:
The DHCP relay device performs multiple functions: it relays DHCP requests between clients and servers, monitors packet traffic for security purposes, identifies malicious clients, and restricts DHCP services when necessary. By combining these functions into a single device, the system improves security without proportionally increasing device complexity
Solution Approach 2:
The DHCP relay device autonomously monitors packet traffic, identifies malicious clients based on their behavior patterns, and restricts their DHCP services without requiring external intervention. This self-service capability allows the system to maintain security while keeping the operational complexity manageable
Data Source
AI summary
A method for defending a DHCP attack is provided. The method includes monitoring packets transmitted by a client terminal coupled to a target port, and determining, in IP addresses allocated for the client terminal coupled to the target port, the number of the IP addresses generating no packet traffic in a preset first time. And the method further includes if the number of the IP addresses generating no packet traffic reaches a preset first threshold, determining that the client terminal coupled to the target port has risk of attacking, and restricting DHCP service of the target port. A device for defending a DHCP attack is also provided.