I was trying to run a Rogue DHCP Server which should cause a MITM attack. I did the following

  • Exhaust the real DHCP Server using DHCPig (worked)
  • Run a Rogue DHCP Server using the auxiliary/server/dhcp module (runs)
  • Cause a device to send a DHCP request

I see the incoming request in wireshark but the real DHCP Server which has no more leases is sending a DHCP NACK Packet which causes the client to cancel his request instantly. This results in the client ignoring the DHCP Offer from my Rogue DHCP Server.

I can thihnk of not exhausting the DHCP Server and "just" be faster which did not work out very well when I tried it.

What is the best way to move the client to accept my DHCP offer?


Plan A: Try using another ip range than the real DHCP server.

A DHCP server is not supposed to NACK a request for an ip outside it's IP range.

Plan B: it is a race condition, so flood the client with DHCPOFFER messages.

Plan C: use arpspoofing, it's much easier.

  • Solution A wont work becase the NACK isn't send as a response to my fake offer its send because the DHCP Server does not have any leases left but B might be possible when I start before the request is sent. – davidb Oct 6 '15 at 13:46
  • Does your client ignore your offers once the first DHCP gives its answer ? – Nate Oct 6 '15 at 13:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.