Security Basics mailing list archives
Re: Preventing DHCP from allocating IPs
From: Tony Meman <none () superig com br>
Date: Sat, 07 Dec 2002 21:29:21 -0200
Someone could just sniff the traffic, collect some valid MAC addresses and use one of
them when some box is down. MAC spoofing is trivial. Regards, -- none Hasnain Atique wrote:
My solution was somewhat more elaborate. I'd separated the network into sections, each connecting to a "backbone" of sorts. Each segment is physically separate with a Linux router/gateway/firewall linking the section to the backbone. Each Linux box knows which MAC addresses are valid within its segment and only allows that through to the backbone. DHCP within each segment allocates IP addresses to known MACs only. Net result is that, unknown MAC addresses firstly don't get a DHCP allocation, and secondly can't make it outside of the local segment. Even if a smart user were to pick and choose an unused IP and used the right gateway address, because of MAC filtering they will be limited to the local segment. The downside is that every single MAC address has to be known before putting this in place (it's easily done with arpwatch), and there will be multiple gateways to maintain. But depending on your level of paranoia you'll probably like it. Finally, I certainly wouldn't want to automate the process of learning MAC addresses and updating DHCP allocation accordingly. Defeats the entire purpose!!
Current thread:
- RE: Preventing DHCP from allocating IPs, (continued)
- RE: Preventing DHCP from allocating IPs Sarbjit Singh Gill (Dec 05)
- Re: Preventing DHCP from allocating IPs jon kintner (Dec 03)
- Re: Preventing DHCP from allocating IPs Pauling (Dec 04)
- Re: Preventing DHCP from allocating IPs Tony Meman (Dec 06)
- RE: Preventing DHCP from allocating IPs Rick Darsey (Dec 04)
- Re: Preventing DHCP from allocating IPs jon kintner (Dec 04)
- RE: Preventing DHCP from allocating IPs Sarbjit Singh Gill (Dec 05)
- Re: Preventing DHCP from allocating IPs Hasnain Atique (Dec 06)
- RE: Preventing DHCP from allocating IPs Sarbjit Singh Gill (Dec 06)
- Re: Preventing DHCP from allocating IPs Hasnain Atique (Dec 06)
- Re: Preventing DHCP from allocating IPs Tony Meman (Dec 09)
- Re: Preventing DHCP from allocating IPs jon kintner (Dec 09)
- Re: Preventing DHCP from allocating IPs Gene (Dec 11)
- Re: Preventing DHCP from allocating IPs Tony Meman (Dec 12)
- Re: Preventing DHCP from allocating IPs Pauling (Dec 04)