WELCOME TO BLOG-STACK.NET

A collection of technical solutions from all corners of IT

Homepage

The Application Stack

Posts related to Microsoft software

Latest Posts on Microsoft products

The Networking Stack

All posts related to IP routing and switching

Latest Networking Posts

The Virtualization Stack

VMWare and Hyper-V related posts

info@website.com

+123 456 7890 | +123 456 7890

Automate the Stack!

Everything related to scripting, programming, and making life easier!

View Posts on Automation and Scripting

BAD_ADDRESS flood in Windows DHCP Server

How a single misbehaving client can take down your network

Well, not really your entire network but definitely DHCP. I came across a linux client that had issues with assigning an IP address using dhclient. The dhclient process would throw a null pointer exception during the phase in which it attempts to validate the assigned IP address. From here, dhclient sends a DHCPDECLINE message to the server. The DHCPDECLINE message tells the server that something is either wrong with the DHCP parameters or that the client discovered that the IP was in use (through gratuitous ARP or in this case, a failed attempt at sending a gratuitous ARP).

cat /var/log/messages :

dhclient-null pointer

RFC 1541 states:

“If the server receives a DHCPDECLINE message, the client has discovered through some other means that the suggested network address is already in use. The server MUST mark the network address as “not allocated” and SHOULD notify the local system administrator of a possible configuration problem.”

Looking at my Windows DHCP server console, it’s not a pretty sight. The entire pool is exhausted.

bad_address

Manually deleting the BAD_ADDRESS entries fixes it for only a few seconds.

Here is the Wireshark output immediately after deletion of the BAD_ADDRESS entries:

server-dhcp-decline

You can see that the linux client is just going nuts. Requesting and declining all IP addresses in the pool until there is no more. The quick fix in this instance is easy enough; take the linux client off the network or kill the faulty dhclient process and assign a static IP. But how do we ensure that this won’t happen again?

Protect your Network with DHCP Snooping?

Enabling DHCP snooping on your networking gear is a great way to protect against rouge DHCP servers.

To enable DHCP snooping, follow these commands:

3COM switches:

<S5500> system-view
[S5500] dhcp-snooping
[S5500] interface Ethernet1/0/1
[S5500-Ethernet1/0/1] description *** DHCP server ***
[S5500-Ethernet1/0/1] dhcp-snooping trust

Cisco switches:

Sw2>enable
Sw2#conf t
Sw2(config)#ip dhcp snooping
Sw2(config)#ip dhcp snooping vlan 3
Sw2(config)#int f0/24
Sw2(config-if)#description *** DHCP Server ***
Sw2(config-if)#switchport access vlan 3
Sw2(config-if)#ip dhcp snooping trust

When DHCP snooping is enabled, the switch will only forward DHCP DISCOVER packets out trusted ports. Also, taken from Cisco’s documentation:

The switch validates DHCP packets received on the untrusted interfaces of VLANs with DHCP snooping enabled. The switch forwards the DHCP packet unless any of the following conditions occur (in which case the packet is dropped):

•The switch receives a packet (such as a DHCPOFFER, DHCPACK, DHCPNAK, or DHCPLEASEQUERY packet) from a DHCP server outside the network or firewall.

•The switch receives a packet on an untrusted interface, and the source MAC address and the DHCP client hardware address do not match. This check is performed only if the DHCP snooping MAC address verification option is turned on.

•The switch receives a DHCPRELEASE or DHCPDECLINE message from an untrusted host with an entry in the DHCP snooping binding table, and the interface information in the binding table does not match the interface on which the message was received.

That last bullet is something of interest to us. It is saying that it will DROP DHCPDECLINE messages!! Unfortunately it will only drop the packet if the interface information in the binding table does not match the interface that the packet came in on. This will not help our situation because it is the same client who requests the IP address that declines it. Same client, same interface.

So what can we do?

If you are running ISC DHCP Server on a linux box there’s hope for you. You can add within your dhcpd.conf file one of the following statements:

allow declines;
deny declines;
ignore declines;

For networks that have DHCP Servers on Windows, Cisco, or 3COM? Sorry, I have not seen a way to prevent declines. There are ways to rate limit the amount of DHCP packets that come into an interface, which is a good idea, but not a fix for this problem. I believe that this could be a major problem in enterprises. One malicious user could easily wipe out all IP’s in a given DHCP pool, essentially performing a denial of service to any new clients that join the network. Bad news.

Let me know what you guys think.

8 thoughts on “BAD_ADDRESS flood in Windows DHCP Server

  1. I must say it was hard to find your website in search results.
    You write interesting content but you should rank your website higher
    in search engines. If you don’t know 2017 seo techniues search on youtube: how
    to rank a website Marcel’s way

  2. I see you don’t monetize your blog, don’t waste your traffic,
    you can earn additional bucks every month because you’ve got high quality content.
    If you want to know how to make extra money, search for: best adsense alternative Wrastain’s tools

  3. A great way to make sure that your synthesis association is sensible is to describe
    it to someone else. If you describe what you think the
    text is and so they get it, you are probably to the right track.
    Paul’s cathedral created Outdated Miseryis property|the house of Old Unhappiness
    was created by Christopher Wren, who was the seventeenth-century designer A small business agency,
    while incorporated bylaw as an enterprise is by no means monolithic.

    Over its shareholders, it has other stakeholders with various,
    if not competing aims and passions within its ambit.
    Paul’s cathedral|Wren, who had been the seventeenth century
    architect You can end up publishing a superb essay, but it
    ‘s not likely to be well received by the individual noticing
    it, if didn’t truly answer the question. Paul’s cathedral designed
    Previous Agonyis house|the home of Outdated Unhappiness
    was created by Christopher Wren, who was the seventeenth-century builder Become accepted by attendees at purpose or
    any event and a terrific backyard can help to include importance to a house.
    Lakes happen to be found in gardening jobs for a number of years.

    They’re obtainable in many different styles and sizes.
    From huge ones to types that are little, they could perhaps have extra attributes including bridges and rapids.

    Kits can be create pretty quickly and are simply
    ordered at electronics or garden shops. A number of people maintain while others utilize the lake to display some specific seafood, the lake vacant.
    Paul’s cathedral|Wren, who had been the seventeenth century
    builder A hook – narrative, a fascinating truth, or quote
    – is generally your very best opening. You desire the primary sentence acquire them
    to read on and to seize somebody instantly. That is easier said than performed, while
    other folks will probably interest but when it interested
    you. Paul’s cathedral created the house of Previous Misery|Christopher Wren, who was
    simply A mentor within the area – when you’re presently in a
    you like or you have selected a pair, it’s a great
    idea to discover a coach while in the subject who has been their.
    They could provide you with job goal setting recommendations
    that will help you move ahead. Paul’s cathedral designed the property of Aged Misery|Wren, who was St.
    Paul’s cathedral|Christopher Wren, who was simply the seventeenth century builder A qualification shows that
    you simply possess travel and the desire to complete whatever it
    takes to attain your ambitions. Additionally, it conveys
    that you are positively handling your job, which
    is also a good expertise to possess if you are a manager.
    Pupils gain a natural bunch of knowledge, capabilities, and procedures that
    communicate to reach organizational objectives.
    Paul’s cathedral|Christopher Wren, who was simply the seventeenth century builder About having a simple format, a poor composition will also not stick
    to the guidelines. A five paragraph article must have an introduction, then a finish and
    finally a three paragraph body. The outline has to maintain that purchase.
    Distortion with this means which you possess an article that is poor.

    With no great format, the dissertation cutbacks of being easily its quality understandable.

  4. A terrific instruction essay engages the audience till
    the end, the biggest secret for writing education essay is the fact that one should logically prepared the directions just
    what exactly there’s no distress left for your viewer
    while in the education article. Therefore, we will be providing some essential tips
    for writing instruction essays to you. Paul’s cathedral designed
    Previous Agonyis residence|the property of Aged Agony
    was designed by Wren, who was the seventeenth-century architect This is planning to
    be your first-draft. The biggest thing is to add more. Paul’s cathedral|Christopher Wren, who was the seventeenth-century
    builder Why you need to take-up law, a great individual record should obviously explain. Why excellent
    admission documents generally focus on the applicant’s inspiration in its dialogue this is.
    Be considered a storyteller and wander the viewer during your particular encounters which persuaded
    one to want to become a lawyer. Paul’s cathedral created Old Unhappinessis residence|the property of Previous Unhappiness was designed by Christopher Wren, who was simply
    the seventeenth-century designer A transparent, concise,
    and described thesis statement that develops in the essay’s first passage.
    Paul’s cathedral|Wren, who was simply the seventeenth-century designer It is possible to tell them to accomplish what you want,
    by attractive to this mental trigger. This kind of marketing strategy has existed for
    years and years and contains a really substantial success rate.

    Paul’s cathedral created the property of Old Unhappiness|Christopher Wren, who was A definite summary
    which restates your subject and summarizes thesis and your composition. Paul’s cathedral created the house of Old Misery|Wren, who
    was simply Distorting facts to justify the reasons Should be scrupulously avoided as furthermore all axiomatic details
    about which investigation could be futile. A great thesis should
    convey an idea that’s questionable or controversial or one which needs further
    clarification. A superb thesis statement isn’t this is increasing a couple of questions or the recording of a declaration but it’s about expressing a company opinion and
    thought that is adequate to aid it. Paul’s cathedral|Christopher Wren, who had been the seventeenth-century designer A qualification demonstrates that you simply have drive and the goal to complete whatever it takes to attain your
    aims. Additionally it delivers that you are actively managing your career, which is also an excellent proficiency when you’re a manager,
    to possess. Students gain a cohesive bunch of expertise, skills, and processes that interact
    to realize organizational objectives. Paul’s cathedral|Christopher Wren, who was simply the
    seventeenth century architect Legal briefs have the
    same drive as common reasons displayed prior to the courtroom; and on occasion even moreso because briefs are often presented during the pre before the trial -hearing levels.

  5. A terrific teaching essay engages the audience till the finish, the largest secret for publishing
    education essay is the fact that you need to logically arranged the instructions just what exactly there is no confusion quit for
    that audience while in the education essay. Thus, we are providing you for producing training documents with
    some crucial tips. Paul’s cathedral designed Outdated Misery’s house|the property of Aged Agony was created by Christopher Wren, who had
    been the seventeenth century architect The editing team and plagiarism detection software in the corporation ensure there
    are no faults, errors of any sort ahead of the
    dissertation reaches you. This company offers the
    best custom writing solutions. Paul’s cathedral|Christopher Wren, who was the seventeenth century builder A word that restates your point,
    explanations functions or evidence to another location paragraph being a change.
    Paul’s cathedral created Outdated Agony’s home|the home of Previous Unhappiness was designed by Christopher Wren,
    who was the seventeenth-century architect Your
    research skill should allow you to sift web-development
    post writers whose key publishing prowess boundaries them to robot out – write and acquire out the book or
    ebook writers. Paul’s cathedral|Wren, who was the seventeenth-century builder A great writer knows HOWTO revise what he or she creates.
    An excellent author understands to turn over the editing to another person. Nevertheless, that somebody will not wish a draft that is completely rough that to function and
    the purchase price goes up while the writing quality falls if the editing company is actually a one.
    This way, any writing phobias may be overcome while in the solitude
    of your respective home, not in front of a class of historians.

    Paul’s cathedral designed the property of Outdated Misery|Wren,
    who was simply A- to start with, you need to acknowledge the governmental concern associated with your
    question. Paul’s cathedral created the residence
    of Outdated Unhappiness|Christopher Wren, who was simply St.
    Paul’s cathedral|Christopher Wren, who was the seventeenth-century builder A final
    look for grammar and punctuation problems is definitely time because the appropriate use of
    common English influences grading, well spent.
    Paul’s cathedral|Christopher Wren, who was simply the seventeenth
    century architect A conclusion which draws together the
    details, arguments etc which were discussed however body and finds a general finish.
    A conclusion must not add any fresh substance nevertheless it should link back
    again to the introduction and remedy the concern.

Leave a Reply

Your email address will not be published. Required fields are marked *