Configuring Defense Against Attacks from Non-DHCP Users

On a DHCP network, users with static IP addresses may initiate attacks such as bogus DHCP server attacks and bogus DHCP Request message attacks. This brings security risks for authorized DHCP users.

Dynamic MAC address entries are learned and generated by the device, and static MAC address entries are configured by command lines. A MAC address entry includes the MAC address, VLAN ID, and port number of a DHCP client. The device implements Layer 2 forwarding based on MAC address entries.

After a static MAC address entry is configured on the user-side interface of the device, the device generates static MAC address entries based on dynamic DHCP snooping binding entries for all DHCP users connected to the interface, clears all the dynamic MAC address entries on the interface, disables the interface from learning dynamic MAC address entries, and enables the interface to match the source MAC address based on the MAC address entries. Only messages whose source MAC addresses match the static MAC address entries can pass through the interface; other messages are discarded. Therefore, the administrator needs to manually configure static MAC address entries for non-DHCP users on the interface so that messages sent from non-DHCP users can pass through; otherwise, DHCP messages are discarded. This prevents attacks from non-DHCP users.