Cisco Ethernet switch Manual do Utilizador descarregar pdf (Página 70)

707070

l2-security-bh.ppt

DHCP Starvation Attack Mitigation

¥ Same techniques that mitigate CAM flooding, can mitigate DHCP

starvation but not the Rogue DHCP server (from the DHCP RFC

2131):

ÒThe client collects DHCPOFFER messages over a period of time, selects one DHCPOFFER

message from the (possibly many) incoming DHCPOFFER messages (e.g., the first

DHCPOFFER message or the DHCPOFFER message from the previously used server) and

extracts the server address from the 'server identifier' option in the DHCPOFFER

message. The time over which the client collects messages and the mechanism used to

select one DHCPOFFER are implementation dependent.Ó

¥ RFC 3118 ÒAuthentication for DHCP MessagesÓ will help, but has yet

to be implemented

¥ Consider using multiple DHCP servers for the different security

zones of your network

¥ DHCP Option 82 on the 3550 can help:

http://www.cisco.com/univercd/cc/td/doc/product/lan/c3550/1219ea1/3550

scg/swdhcp82.htm

¥ Cisco is developing a DHCP ÒfirewallÓ for initial implementation in

our higher-end switches

1 2 ... 65 66 67 68 69 70 71 72 73 74 75 ... 83 84

Sem comentários

Cisco Ethernet switch Manual do Utilizador Página 70