Dhcprelease issue

   *** From dhcp-server -- To unsubscribe, see the end of this message. ***


Hello:

        Using a modificated "dhcping" from
http://www.mavetju.org/unix/general.php that only sends DHCPRELEASE
packets, we've seen that a malicious client can send this kind of
packets with different mac and client IP address inserted into de DHCP
part.

        We've seen that the unicast packet that arrives to the server, in its
IP headers, holds the "attacker" IP address. It seems that the server
doesn't perform any check to verify that the IP source address is the
same that the client IP address to be released.

        Should the server do this comparison?

        Is there a way to protect the server from this malicious packets?

        Thank you very much.

hostmaster@xxxxxxxxxxxx




-----------------------------------------------------------------------
List Archives : http://www.isc.org/ml-archives/dhcp-server/
Unsubscribe   : http://www.isc.org/dhcp-lists.html    
-or-          : mailto:dhcp-server-request@xxxxxxx?Subject=unsubscribe  
-----------------------------------------------------------------------