by default in Microsoft DHCP server configuration Bootp is enabled and choose both(accept DHCP request and Bootp )

i know that how this work and know about how configure two DHCP Server by Bootp enabled router. but i have a question...

can be this default configuration a security risk?

if can, how this make hack? (theoreticaly)

for example : in CISCO documents we have this:

Option to Ignore All BOOTP Requests

why we ignore that? a security reason?


DHCP supersedes BOOTP; you keep BOOTP around only to help old hardware and software which does not know DHCP. Anyway, both are about offering a service to whoever asks (namely, IP address allocation and publication of network configuration) so they are no more, and no less, a security issue than what their definition entails: by running a DHCP or BOOTP server, you make it easy for people to plug in and get network connectivity.

Neither is more secure than the other, but if you offer both then you must mind both when it comes to controlling access to that service (e.g. MAC filtering). See this page for a comparison.

The usual security stance applies: if a service is not needed for operations, then don't enable it. To know if a service is needed for operations, disable it and see what breaks. In that case, deactivate BOOTP, and if you can live without it (which is probable), just leave it deactivated.

  • if someone ask me about the MAC filtering security he said :: what we done by those use HACK application that can clone a mac address and connect us by it. – saber tabatabaee yazdi Feb 19 '13 at 5:09

Enabling a diskless bootstrapping feature option (BOOTP) for DHCP when you don’t need it would expand your attack surface and diminish your overall security posture.

Any system that can accomplish a network boot (typically a Preboot Execution Environment PXE boot feature in the BIOS) would be provided another method to boot and gain access to the system. The network boot attack would almost certainly be an insider attack as other boot image configuration would be needed. The attacker is aided when owning the system by network boot by the fact that no persistent logging will occur on the target system as the OS is running in RAM with all details lost at power off or reboot.

Also BOOTP services typically use Trivial File Transfer Protocol (TFTP) to enable the movement of the boot image across the network,. TFTP is ‘trivial’ due to the lack of authentication in its protocol. Unauthenticated FTP on your system when it is not needed is yet more diminished security.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.