Classification of DHCP Spoofing and Effectiveness of DHCP Snooping
It is well known that DHCP snooping is a famous countermeasure against DHCP spoofing. Actually, to what extent DHCP snooping can protect the authenticated DHCP clients from being given malicious DHCP transactions through the network where the authenticated DHCP clients and the malicious DHCP servers share with each other? The answer to this question is that DHCP snooping can protect DHCP spoofing to a certain extent, though DHCP snooping cannot protect DHCP spoofing completely. In the former half of this paper, it is shown that DHCP spoofing can be classified into two cases, namely DHCP spoofing from inside and DHCP spoofing from outside, and in the latter half of this paper, it is shown that DHCP snooping can protect the former attack from being implemented but cannot protect the latter attack from being implemented. More exactly speaking, it is shown that DHCP snooping cannot prevent DHCP spoofing from outside from being implemented, while applying the longest matching prefix rule to leading a malicious network segment which is constructed on the basis of the leaked DHCP transactions beforehand.