Checking CHADDR Field
In the DHCP exhaustion attack, attackers continuously apply for IP addresses through DHCP REQUEST packets with various MAC addresses and CHADDR fields until all IP addresses in the address pool are exhausted. To prevent the DHCP exhaustion attack, the MAC address limitation function is introduced. Details about MAC address limitation are not mentioned here. The DHCP REQUEST packets from attackers with changing CHADDR fields and unchanging source MAC addresses disable the MAC address limitation function.
An interface enabled with DHCP snooping can check whether the source MAC address in an Ethernet frame is the same as that in the CHADDR field of the DHCP REQUEST packet. If they are different, the interface discards the DHCP REQUEST packet.
Figure 1 Checking the CHADDR field
