Subject: [dhcwg] DDoS and DHCP servers

From: "Templin, Fred L" <[email-masked]>
Date: Tue, 1 Nov 2016 21:33:38 +0000

Hi,

The Oct. 21, 2016 DDoS attack on the Internet has me wondering about the
DDoS vulnerability profile for DHCP servers (mostly interested in DHCPv6).

Are there any mitigations that could be employed to protect DHCPv6 servers
from DDoS attacks?

Thanks - Fred
[email-masked]

---

From: Simon Hobson <[email-masked]>
Date: Tue, 1 Nov 2016 22:18:14 +0000

> Are there any mitigations that could be employed to protect DHCPv6 servers

My feeling is that it's going to be a non-issue. I can't see many DHCP servers being exposed to the internet - other than (for example) those serving customers of an ISP. As such :
- there shouldn't be many (if any) DHCP servers exposed
- the traffic is easily filtered at the border (it's not a protocol you'd need to be handling inbound or outbound).
- and even if some packets get through, the server they reach won't be configured to be serving arbitrary subnets. Ie, if you sent client request packets for some arbitrary public IP (to create a reflection attack on that IP), it's highly unlikely that the server will be configured to serve up that IP.