DHCP Offer Frame Filtering on Network Switches

Resolve Bottlenecks,
Find Innovative SolutionsGenerate Solutions

Solution Overview

Problem

The proliferation of consumer-grade DHCP-enabled devices can lead to conflicts with existing networks, resulting in rogue DHCP servers that assign duplicate IP addresses, disrupting network services due to their default settings and lack of authorization.

Innovation Solution

Implementing methods to control DHCP communication on network switches by identifying and dropping DHCP offer frames from unauthorized servers, thereby disabling rogue DHCP servers and preventing service disruptions.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If consumer-grade DHCP-enabled devices are deployed to simplify network configuration, then ease of operation is improved, but network reliability deteriorates due to rogue DHCP servers assigning duplicate IP addresses

Engineering Contradiction:

Improvenetwork configurationVSAvoidnetwork service stability

Core Design Contradiction:

Ease of operationVSReliability

Solution Approach 1:

The network switch acts as an intermediary between DHCP clients and potential rogue DHCP servers. By implementing DHCP offer frame filtering at the switch level, authorized DHCP servers can continue providing convenient automatic IP address assignment while rogue servers are blocked from interfering with the network. The switch mediates the conflict by selectively allowing only frames from authorized sources.

Inventive Principle:

Principle #24Intermediary (Mediator)

2Ease of manufacture

If DHCP service is enabled as a default setting on network devices, then ease of manufacture and deployment is improved, but network reliability worsens due to unauthorized DHCP servers disrupting service

Engineering Contradiction:

Improvedevice configurationVSAvoidnetwork service integrity

Core Design Contradiction:

Ease of manufactureVSReliability

Solution Approach 1:

The network switch proactively prevents rogue DHCP servers from causing harm by filtering out unauthorized DHCP offer frames before they can be processed by clients. This preliminary action blocks the harmful effect (duplicate IP assignment) before it occurs, while still allowing legitimate DHCP service to function normally when authorized servers are present.

Inventive Principle:

Principle #9Preliminary anti-action

3Adaptability or versatility

If multiple DHCP servers are deployed to provide flexible addressing, then adaptability is improved, but network reliability deteriorates due to duplicate IP address assignment

Engineering Contradiction:

ImproveIP address assignment flexibilityVSAvoidIP address uniqueness

Core Design Contradiction:

Adaptability or versatilityVSReliability

Solution Approach 1:

The DHCP filtering mechanism applies different qualities to different network segments. Authorized DHCP servers maintain full functionality in their local networks, while rogue servers are blocked at the switch level. This creates localized trust zones where IP address assignment is reliable within authorized domains while still allowing flexibility across the broader network through proper DHCP operation.

Inventive Principle:

Principle #3Local quality

Data Source

PatentUS7756976B2Systems and methods for denying rogue DHCP services

Publication Date: 2010.07.13 HEWLETT PACKARD ENTERPRISE DEV LP

AI summary

Methods of controlling dynamic host control protocol (DHCP) communication on a network are presented including: receiving a data frame on a network switch; and if the data frame is a DHCP offer frame that is not received from an authorized DHCP server port, dropping the data frame. In some embodiments, methods further include if the data frame is not the DHCP offer frame, forwarding the data frame. In some embodiments, methods further include if the data frame is the DHCP offer frame that is received from the authorized DHCP server port, forwarding the data frame.