Re: Possible DHCP DOS attack

[sen_ml () ECCOSYS COM (Sen_Ml Sen_Ml)]

paul> 3)You should always be able to track an offending mac down
paul> to at least a switch port, and if you are using managed
paul> hubs, then a hub port too.  The thing is that you are making
paul> up your MACs in this case, and they are only used very
paul> briefly, so they will likely have timed out in the switches
paul> and hubs by the time the admin gets around to looking for
paul> them.

as far as the dhcp dos attack is concerned, does configuring the dhcp
servers to only hand out ip addresses to registered mac addresses work
for you?  my guess would be no ;-)

it doesn't do anything to stop people from just assigning themselves
an ip address and it's a pain to administer for large sites, but fwiw
it's what i do for small networks.