How DHCP Works: DORA, Starvation & Rogue DHCP Attacks (Animated)

DHCP gives a device everything it needs to join a network automatically: an IP address, subnet mask, default gateway and DNS server. It happens in four steps known as DORA. Because clients trust the first answer they hear, a rogue DHCP server can silently redirect all their traffic.

1. Discover: is there a dhcp server?

A new device has no IP address and doesn’t know where the server is, so it broadcasts to everyone on the LAN.

1. DISCOVER (New laptop → everyone on the LAN): Source 0.0.0.0 because the laptop has no address; destination 255.255.255.255 so every device hears it.

Wireshark filter:

dhcp

2. Offer: here is an address you can use

The DHCP server picks a free address from its pool and offers it, along with the settings the client will need.

1. OFFER (Router (DHCP server) → New laptop): The offer includes the gateway and DNS server. Whoever controls those two values controls where the client’s traffic goes.

Wireshark filter:

dhcp.option.dhcp == 2

3. Request & ack: deal confirmed

The client formally requests the offered address (again by broadcast, so other DHCP servers know which offer was chosen), and the server confirms.

1. REQUEST (New laptop → everyone on the LAN): Still a broadcast, naming the chosen server.
2. ACK (Router (DHCP server) → New laptop): The lease starts. The laptop configures itself and is online, all in a few milliseconds.

Wireshark filter:

dhcp.option.dhcp == 3 || dhcp.option.dhcp == 5

4. Dhcp starvation: attack: taking every address

The attacker floods the server with Discover messages from thousands of fake MAC addresses until the pool is empty. Real devices can no longer get an address.

1. DISCOVER (Attacker (rogue DHCP) → Router (DHCP server)): Every fake request reserves one address. Watch the pool meter fill.

Wireshark filter:

dhcp.option.dhcp == 1

5. Rogue dhcp server: attack: the attacker hands out the settings

With the real server empty, the attacker’s own DHCP server answers instead, and names itself as gateway and DNS server.

1. DISCOVER (New laptop → everyone on the LAN): A real user joins the network and asks for an address.
2. OFFER (Attacker (rogue DHCP) → New laptop): The client accepts it. From now on all its traffic and all its DNS lookups go through the attacker: a man-in-the-middle without touching ARP.

Wireshark filter:

dhcp.option.dhcp == 2 && ip.src != 192.168.1.1

6. Dhcp snooping: defence: only trusted ports may answer

A managed switch marks the port leading to the real DHCP server as trusted. Offers from any other port are dropped, and each port is limited to a few requests per second.

1. OFFER (Attacker (rogue DHCP) → New laptop): The switch sees a server message arriving on an untrusted port and drops it.
2. OFFER (Router (DHCP server) → New laptop): Only the real server’s offer reaches the client.

Switch config (cisco):

ip dhcp snooping
ip dhcp snooping vlan 10
interface Gi0/1
 ip dhcp snooping trust

FAQ