Middleman Attack and IP/MAC Spoofing Attack
The DHCP snooping binding table contains information about the IP address, MAC address, VLAN, interface, and lease. The DHCP snooping binding table consists of static binding entries and dynamic binding entries. Static binding entries are manually configured and contain information about static users. Dynamic binding entries are generated according to the information carried in the DHCP REPLY packets sent from the DHCP server, and contain the information about the IP address, MAC address, VLAN, and access interface. The life cycle of a dynamic binding entry equals the lease of an IP address.
After receiving IP packets, ARP packets, and DHCP packets for extending the IP address lease, the device checks whether the received packets are valid, filters out invalid packets, and collects statistics on them according to information in binding entries. If the number of discarded invalid packets exceeds the set threshold, trap messages are generated and then sent as required to the NMS for informing users.
The following lists two common scenarios of attacks:
Middleman attack
A middleman sends an ARP packet carrying its own MAC address and the IP address of the DHCP server to the client. The client then learns the entry containing the IP address of the DHCP server and its MAC address, and considers the middleman as the DHCP server. In this case, all the packets sent from the DHCP client to the server pass the middleman.
A middleman sends an ARP packet carrying its own MAC address and the IP address of the DHCP client to the server. The server then learns the ARP entry containing its own MAC address and the IP address of the DHCP client, and considers the middleman as the DHCP client. In this case, all the packets sent from the DHCP server to the client pass the middleman.
Figure 1 Middleman attack
IP/MAC spoofing attack
The attacker initiates an attack by forging the IP address and MAC address of an authorized user.
Figure 2 IP/MAC spoofing attack
The DHCP snooping binding table is a solution to such an attack. The device connected to users listens to received DHCP ACK packets and generates DHCP snooping binding entries for untrusted interfaces. DHCP snooping binding entries define the binding relationship between the MAC address, IP address, VLAN, and interface, and are not deleted until the lease expires. When receiving an ARP, IPv4, or IPv6 packet from an untrusted interface, if no matching binding table is found, the device directly discards the packet.
Figure 3 Discarding invalid packets by using DHCP snooping
