In DHCPig I have the option to send RELEASE packets to all hosts in the network. This should result in the hosts discarding their configuration.

This is the command I ran:

pig.py -r eth0

I did run this attack but the hosts did not discard their IP configuration. Does anyone have an idea how to operate it?

  • For clarity I would suggest that you add the OS and commands you're trying to run in the question (not in the title). – Mrtn Sep 26 '16 at 11:38
  • @Mrtn pig.py -r eth0 pig.py for the tool -r for release eth 0 for the interface – Antonio Sep 26 '16 at 13:18

You did misunderstand the attack. The faked packages aren't send to the client. They are sent to the server with the address of the client you want to dos as the sender. The goal of this attack is to make the server believe that the address is available again. This will only work if you prevent the real client from communicating with that server.

You can find a documentation of how this is best done here.

// When a Host obtains a DHCP lease there come some limits with it. The lease has a lifetime after which it expires if it isn't extended. But there is also an additional time limit which is called renewal time which is the time limit after which the client should talk to the DHCP server again to extend the lease. Many operattion systems even renew their lease more often than imlied by the renewal time.

When you now start portstealing your target and send a RELEASE Packet to the DHCP server the server will mark the lease as available again. You then start aquireing this lease with a fake mac address using DHCPig. When the targeted client then talks to the DHCP Server to renew his lease the server will send a NACK packet which will prevent the lease from beeing extended at least and might cause the client to discard his configuration.

| improve this answer | |
  • Let's take a situation - I did ARP SPOOF between the DHCP client and server, now the client thinks I'm the server and the server thinks im the client. i prevented the communication between them (say by IPTables with ports 67/68), the server gave the address of the client. And what then? The address was still on the client . What have we accomplished? – Antonio Sep 26 '16 at 10:54
  • I would be happy if you answer. – Antonio Sep 27 '16 at 11:54
  • So what is the best way to prevent communication between the host and the dhcp server? – Antonio Sep 28 '16 at 15:29
  • Portstealing I would say. – davidb Sep 28 '16 at 17:59
  • ok i will try it. but when the server will give this address to another host , i will make an conflict ip address on the windows machine, and what then? – Antonio Sep 28 '16 at 20:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.