Subject: Re: [dhcwg] DDoS and DHCP servers

From: "Bernie Volz (volz)" <[email-masked]>
Date: Wed, 2 Nov 2016 02:02:54 +0000

Fred:

Usually the simplest and best practice is to not allow DHCP traffic from
the outside. Why would someone on the Internet need to use your DHCP
server? Most of the DDOS attacks occur over the Internet and thus blocking
the traffic at the front gate is the best.

Protecting against DDoS inside an administrative domain, should it occur
at a scale that is sufficiently high, is very difficult to protect
against. The servers will be overwhelmed and drop packets (that’s the
Denial part), and by flooding the server the idea is that the good packets
are few and far between and so are likely to be dropped.

There are some interesting concepts that one could think of using, for
example prefer DHCPREQUEST (or DHCPv6 Request, Renew) over DHCPDISCOVER
(or DHCPv6 Solicit). We actually have such a mechanism in the server I
work on (we limit the number of DHCPDISCOVER/Solicits we’ll process to
leave some headroom for other packets) — this is to assure if a client
gets a DHCPOFFER or Advertise, it is more likely to be successful in
getting the follow on packet in.

- Bernie

On 11/1/16, 5:33 PM, "dhcwg on behalf of Templin, Fred L"
<[email-masked] on behalf of [email-masked]> wrote:

>Hi,
>
>The Oct. 21, 2016 DDoS attack on the Internet has me wondering about the
>DDoS vulnerability profile for DHCP servers (mostly interested in DHCPv6).
>
>Are there any mitigations that could be employed to protect DHCPv6 servers
>from DDoS attacks?
>
>Thanks - Fred
>[email-masked]
>
>_______________________________________________
>dhcwg mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/dhcwg

---

From: Simon Hobson <[email-masked]>
Date: Wed, 2 Nov 2016 07:57:26 +0000

Bernie Volz (volz) <[email-masked]> wrote:

> against.

I can't help thinking that the best way of mitigating against a DoS attack from inside is simply to have the tools to detect it and a plan to deal with it. If you are large enough that tracking down the offender is a big job, then you are also almost certainly large enough that you'll have managed switched and can (as a first step) simply switch off part (perhaps a single site/location, or when you've tracked it down, a single port) of the network if that's what it takes. And follow that up with a visit to the desk responsible armed with your trusty clue by four :D
In a flat network, you'll have the source MAC address and can use the switch forwarding tables to determine the location. In a routed network, you can add a filter at the router to block DHCP traffic from a segment while you track down the source.

---

From: "Templin, Fred L" <[email-masked]>
Date: Wed, 2 Nov 2016 14:13:23 +0000

Thanks Simon and Bernie,

I am concerned about a DDoS attack that would take down a DHCPv6 server even
for just a short time (e.g., several minutes) even if the attackers were traced and
shut down after the initial DDoS volley. And, inside a large network (e.g., a
cellular operator's network) a coordinated insider attack is imaginable.

Regards - Fred

> -----Original Message-----
> From: dhcwg [mailto:[email-masked]] On Behalf Of Simon Hobson
> Sent: Wednesday, November 02, 2016 12:57 AM
> To: [email-masked]
> Subject: Re: [dhcwg] DDoS and DHCP servers
> 
> I can't help thinking that the best way of mitigating against a DoS attack from inside is simply to have the tools to detect it and a plan to
> deal with it. If you are large enough that tracking down the offender is a big job, then you are also almost certainly large enough that
> you'll have managed switched and can (as a first step) simply switch off part (perhaps a single site/location, or when you've tracked it
> down, a single port) of the network if that's what it takes. And follow that up with a visit to the desk responsible armed with your
> trusty clue by four :D
> In a flat network, you'll have the source MAC address and can use the switch forwarding tables to determine the location. In a routed
> network, you can add a filter at the router to block DHCP traffic from a segment while you track down the source.
>

---

From: Andre Kostur <[email-masked]>
Date: Wed, 2 Nov 2016 07:15:18 -0700

> In a flat network, you'll have the source MAC address and can use the switch forwarding tables to determine the location. In a routed network, you can add a filter at the router to block DHCP traff…

Well... that would be something for an enterprise deployment, but is a
little more problematic for an ISP.   You can't just cut off a few
thousand customers (particularly since some of those customers may be
relying on that network like for 911 telephony services...).   Much
like Bernie, we also do some logic on incoming traffic to be able to
deal with DoS attacks, unintentional DoS attacks (also known as
misbehaving clients), as well as inrush events.

If you aren't accepting unicast DHCPv6 traffic, then you may be able
to push some of the DoS mitigation out to your relays.

-- 
Andre Kostur

---

From: Ted Lemon <[email-masked]>
Date: Wed, 2 Nov 2016 10:45:27 -0400

The typical way to deal with this is to limit the number of leases
that can be assigned per port.   Most DHCP servers have a way to
configure this.   It requires that your switch send a port identifier
in the relay information portion of the DHCP packet.