Rogue DHCP Server
A rogue DHCP server provides unauthorized network configuration, potentially directing clients to malicious gateways or DNS resolvers.
Mechanism
Clients accept DHCP offers according to protocol behavior. An unauthorized responder can therefore influence addressing and network configuration if switch controls are weak.
Indicators to watch
DHCP offers from unexpected ports, inconsistent gateway/DNS values, multiple DHCP responders, and sudden client configuration changes.
Concept diagram
Defensive controls
Enable DHCP snooping/trusted ports, segment networks, monitor DHCP traffic, and investigate unexpected responders.
Recommended security control
DHCP snooping + packet capture
Use a virtual LAN with synthetic clients.
Defence practice lab
The administrator has not attached a tool link yet. This slot will show “Build Soon” until an external link is configured.
Defence techniques
Defence techniques for this attack will be added by the administrator.
All attack descriptions are for defensive education. Test scanning, traffic generation, interception, wireless testing, and vulnerable applications only on systems and networks you own or are explicitly authorized to assess.