Rogue DHCP and ARP spoofing: DHCP snooping and DAI

A rogue DHCP server answers new clients before the real one, and hands out its own address as the gateway or the DNS server.

ARP spoofing gets the same result on hosts that already have an address: it tells them the gateway's IP now lives at the attacker's MAC address.

DHCP snooping is disabled by default on Cisco, Huawei, Aruba and Juniper.

One port in the VLAN. No account. Both protocols accept the first plausible answer, and nothing in them checks who is speaking.

A new laptop asks for an address. Two servers answer: the real one, far away, and the rogue one, next door. The first answer wins.

For machines already running, the ARP table is rewritten, and the gateway's address now points to the attacker. Every packet passes through a machine that was never meant to see it.

Clients use the attacker as their gateway or DNS server. Traffic can be read and changed in the middle.

And the network looks normal: everyone still gets an address, and everything still works.

Turn on DHCP snooping on user VLANs, and trust only the ports that lead to your real DHCP servers. Then turn on Dynamic ARP Inspection, which checks ARP against the addresses snooping recorded.

Cisco limits ARP on untrusted ports to 15 packets per second by default, and shuts a port that goes over.

And one Juniper detail: trunk ports are trusted by default, so ARP on a trunk skips the inspection.

NacTrack checks Cisco and Huawei switches for DHCP snooping and Dynamic ARP Inspection.

Sources: RFC 826, RFC 2131, Cisco Catalyst 9300 DHCP snooping and DAI guides, Huawei, Aruba AOS-CX 10.14, Juniper EX.

Defensive education: the attack is shown in principle only, with no exploitation steps, tools or payloads. Command outputs and configurations are examples; check your platform and release in the vendor's documentation.