DHCP starvation attacks are easy to run, but can be crippling to a network. Open-source tools let attackers send thousands of forged Dynamic Host Configuration Protocol (DHCP) requests in under a minute. These attacks exhaust the available Internet Protocol (IP) addresses in a subnet’s pool. That leaves legitimate laptops, phones, and Internet of Things (IoT) devices unable to connect.
When that happens downtime is an inevitable result. Printers and VoIP phones stop working and new employees or guests can’t access the network. This attack is clever as it uses protocol behavior trusted by every network, so it works anywhere active protections aren’t in place.
This guide walks through how DHCP starvation attacks work step by step, the tools that can automate it, and the switch-level approaches that can stop it before addresses run out.
What Is a DHCP Starvation Attack?
A DHCP starvation attack is a denial-of-service (DoS) technique that involves an attacker flooding a DHCP server with forged lease requests and continuing until every address in its pool is tied to a nonexistent device.
Each fraudulent request has a spoofed media access control (MAC) address, so the server can’t distinguish the attacker amidst a thousand different clients.
Servers can’t function with an empty pool. Any new device trying to join the network, whether it’s a new laptop, a rebooted printer, or a phone reconnecting, can’t get an address and is denied network access until an administrator intervenes.
To learn more about the lease process DHCP relies on, see our guide on the DHCP protocol.
How a DHCP Starvation Attack Works
The attack vector is the handshake that every device uses to join a network. Here’s one way it works:
- Discover flood: Attackers send a stream of DHCPDISCOVER messages, each with a separate MAC address so the server thinks every request comes from a different client.
- Offer and reservation: The server answers each DHCPDISCOVER with a DHCPOFFER, saving one pool address for each fake MAC address.
- Completion of the lease: Attackers complete the handshake with a DHCPREQUEST and accept the DHCPACK, claiming a lease that can’t be taken back until it expires.
- Repeat until exhausted: The first three steps run over and over, often more than once a second until the address pool is drained.
- Denial of service takes effect: The next legitimate device that sends a DHCPDISCOVER won’t get an offer as there’s nothing left.
The torrent of incoming messages looks like ordinary lease activity because it uses standard DHCP messages sent via UDP port 67 on the server and UDP port 68 on the client.
Common DHCP Starvation Attack Tools
There are two open-source tools behind many DHCP starvation attacks:
- Yersinia: An open-source framework for layer 2 attacks that includes a DHCP-starvation module as well as modules for Spanning Tree Protocol, Cisco Discovery Protocol, and several others. Security teams commonly use it to check whether a switch has any defenses against pool-exhaustion.
- dhcpstarv: A purpose-built tool that requests and renews leases until the target pool is drained. The tools documentation says it’s meant to be used as a way to temporarily starve out a rogue DHCP server while administrators locate and disconnect it, not for fraudulent activity.
The two tools accomplish the same thing in different ways. Yersinia’s DHCP denial-of-service module loops DHCPDISCOVER messages, generating a fresh MAC address for each one but never sends the DHCPREQUEST that would complete a lease. By contrast, dhcpstarv takes real leases and requests and renews them on a schedule so the pool stays empty.
Why DHCP Starvation Attacks Matter
An exhausted address pool is more than an annoyance. Every device that fails to secure a lease loses network access, creating an outage that often looks like a routine network failure instead of an attack, which is often the intended effect.
A denial of service attack is rarely the end goal. Once a legitimate server’s pool is dry, attackers may inject a rogue server into the network to issue malicious leases, or a hostile default gateway.
That second stage is also called DHCP spoofing, because an adversary impersonates a DHCP server to redirect victim traffic. That attack is distinct and entails its own defenses, which we cover in depth in our guide on Layer 2 attacks against Wi-Fi networks.
See your security gap before attackers do.
See continuous trust in action on a platform that includes RADIUS, PKI and AI security.
DHCP Starvation Attacks on Wireless Networks
Wired switch ports are common targets for DHCP starvation attacks, but they also work over Wi-Fi.
Any client connected to an access point, such as a guest device or a compromised endpoint, can broadcast the same flood of fake DHCPDISCOVER messages across the wireless virtual local area network (VLAN) that access point serves.
Wireless clients typically share a DHCP scope with a greater number of devices than a single wired port, so a starvation attack launched from one compromised phone can halt leasing for an entire floor or building. If a network uses open or weakly authenticated Wi-Fi, where any device can join without proving its identity, attackers have free rein.
How to Detect DHCP Starvation Attacks
If an attack happens, catching it early limits the number of addresses an attacker can capture before draining the pool. Options to monitor for trouble include:
- DHCP server logs: A sudden spike in of DHCPDISCOVER messages from brand new MAC addresses, especially when they come through a single switch port, is a clear indication of a DHCP starvation attack.
- Lease pool utilization: Watching to see how quickly available addresses get used up can indicate a starvation attempt in progress.
- Switch port statistics: If a single port is suddenly sending far more requests than average, a spoofing tool is likely to blame.
- Binding table anomalies: On switches running DHCP snooping many short-lived bindings on a single port that never renew is a common starvation hallmark.
How to Prevent DHCP Starvation Attacks
A layered defense comprising multiple approaches ensures all the gaps are covered. These are best practices:
- DHCP snooping: Enabling DHCP snooping on access switches, typically through the ip dhcp snooping command family, compiles a list of trusted server ports and validated client bindings, then stops DHCP traffic arriving from anywhere else.
- Port security: By limiting each switch port to learning just a set number of MAC addresses, the number of forged addresses one attacking device can generate will be capped.
- Rate limiting: Using ip dhcp snooping limit rate to cap the rate of DHCP messages a port or VLAN accepts limits how quickly an attacker can take up addresses, independent of snooping or port security.
- Network access control (NAC): Requiring devices to authenticate before they reach a switch port forestalls anonymous access, something every DHCP tool relies on.
The most robust version of NACis 802.1X port-based authentication, the IEEE standard for authenticating a device’s identity. If a device can’t authenticate it can’t ever send a single DHCPDISCOVER.
Certificate-Based Network Access Reduces the Attack Surface
DHCP snooping, port security, and rate limiting are still the best technical defenses against DHCP starvation. Cloud RADIUS servers add another layer of defense by limiting who can reach the switch port in the first place.
JoinNow Cloud RADIUS from SecureW2 along with 802.1X authenticates every device before the port will forward anything other than 802.1X authentication traffic, to say nothing of letting it overwhelm a DHCP server with forged requests. In addition, JoinNow Dynamic PKI, a public key infrastructure (PKI) service, issues each device its own certificate, replacing shared passwords, meaning attackers can’t connect automated tools and start talking to a network without a valid, provisioned credential.
This approach doesn’t replace switch-level DHCP defenses, but it drastically shrinks the population of devices that could carry an attack out.
Schedule a demo to learn how certificate-based 802.1X authentication is one layer in the defense against DHCP starvation attacks.
Key Takeaways
- A DHCP starvation attack floods a DHCP server with bogus requests, exhausting its address pool
- Tools like Yersinia, which forges a new MAC address per request, and dhcpstarv can automate these attacks.
- Safeguards such as DHCP snooping, port security, and rate limiting each address a different gap leading to DHCP starvation attacks.
Frequently Asked Questions
Is DHCP starvation the same as DHCP spoofing?
No. Starvation is a denial-of-service attack that drains the address pool so legitimate devices can’t gain access. Spoofing is a separate follow-on stage involving a rogue DHCP server that issues malicious configuration, including a hostile gateway. Attackers sometimes combine the two: starve the legitimate server first, then provide a rogue server once client requests go unanswered.
Can DHCP snooping alone stop a DHCP starvation attack?
Not by itself. DHCP snooping limits which ports can act as a DHCP server and creates a table of legitimate leases, but it doesn’t cap lease requests from a single port. DHCP snooping is usually used alongside port security and rate limiting to reduce flood of forged MAC addresses at the port before it ever reaches the server.
Can DHCP starvation happen on a wireless network?
Yes. DHCPDISCOVER requests can be sent over a VLAN from any client already allowed on an access point. Open or weakly authenticated Wi-Fi makes this access far easier.
How long does a DHCP starvation attack take to exhaust a pool?
It depends on the size of the pool and how fast the attacking tool can generate lease requests. Some tools flood DHCPDISCOVER messages without ever completing a lease; others take real leases and renew them so the addresses are never released. Nothing in the protocol stops a non-compliant client from requesting leases as fast as it likes, so an attack against an unprotected network often moves quickly. Such attacks are typically only noted if lease-utilization alerts or DHCP logging are already in place.
