Re: Possible DHCP DOS attack

[vlad () SANDY RU (Vladimir Dubrovin)]

Hello Tal Hornstein,

03.02.2000 11:02, you wrote: Possible DHCP DOS attack;

T> 2- I would assume any security admin in his right mind will not allow DHCP
T> request from the Internet through the Firewall, thus such an attack can only
T> come from within.

DHCP  requests  cann't come from Internet. Suport of BootP relay agent
(RFC  1532/1542)  is required for routing requests between 2 networks.
DHCP requests use 0.0.0.0 as both SRC and DST address.

P.S. Someone said DHCP "pings" old leases. He's wrong. DHCP will never
release lease before it's expired.

  +=-=-=-=-=-=-=-=-=+
  |Vladimir Dubrovin|
  | Sandy Info, ISP |
  +=-=-=-=-=-=-=-=-=+