Is there any way to prevent a DHCP Starvation attack when using a wireless network with anonymous users?
- Port security cannot be used since maxing the number of clients that can connect on a port would block legitimate users too, which is essentially what the attacker wants to achieve in the first place.
- DHCP snooping is useless without port security since an attacker can spoof his MAC address in the Ethernet packet, as well as in the DHCP payload.
I found one source which claimed that MAC address spoofing is impossible because of the 802.11 standards, which would solve the problem, but after some further looking, I could not find any other source validating this.
- This is not a duplicate of How to prevent DHCP Starvation attack? since I already found that question before I asked mine. The difference is the "wireless network" part which makes a huge difference since port security is not a possible solution.
- By anonymous I do mean random people which makes mac filtering impossible too. How do public wifi spots solve this? Do they?