The client and the DHCP server exchange four messages (Discover, Offer, Request and Acknowledge) before reaching agreement on leasing a certain IP address for a certain time. On the other hand, the attack consists of spoofing DHCP Discover packets with forged MAC addresses. The server would then offer an IP address/a range of IP addresses to the client and awaits for a request.

My understanding of this process says that although the server suggests an IP address, it does not allocate it for the client until sending him the Acknowledgement message. Therefore there will be no exhaustion of DHCP IP addresses due to those forged Discover messages. Thus, the attack does not make sense for me. Could anyone please clarify this to me?


DHCP servers will allocate the IP given in the offer temporarily to negate race conditions. Assume two clients ask for an IP in the same time period, the server must give each client a different address, if it doesn't put aside the first client's IP it might give the second client the same IP causing a collision. So when offering the server locks the address offered until a timeout or until the DHCP transaction has ended.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.