I am running pfSense on an edge firewall conncted to a cable line. I can see many DHCP requests hitting my firewall. I guess this requests are getting send by cable modems currently booting up and looking for the ISPs DHCP server, which later on hands out DNS server and TFTP options, so the modem knows on what parameters to run on and where the GW is.
I started wondering: What if someone set's up a WAN facing DHCP server and answers those requests? That bogus DHCP server could offer a DNS server/GW IP address which is equal to its own and intercept/re-route all traffic.
I know that my ISP uses DOCSIS version 3, which offers forms of authentication and encryption. However I am not aware of the implication to the IP assignement and cable modem setup procedure.
Is such a scenario possible? If yes, how can I protect myself from it? This MITM would be hard to detect.