What Is DHCP Spoofing?
On this page
DHCP spoofing plants a rogue DHCP server on a local network to feed victims malicious configuration. DHCP is how devices automatically get their IP address, gateway, and DNS server when they join a network — and it trusts the first answer it receives. An attacker who answers faster than the real server controls the victim’s network settings, and thereby their traffic. It is a link-layer route to man-in-the-middle.
How does the attack work?#
When a device joins a network, it broadcasts a request for configuration. Any DHCP server can answer, and the client takes the first valid reply:
- The attacker runs a rogue DHCP server on the segment.
- A victim requests configuration; the attacker replies quickly.
- The reply sets the default gateway (and often DNS) to the attacker’s machine.
- The victim now sends its traffic through the attacker, who can read or alter it.
Because it hands out the gateway, DHCP spoofing quietly positions the attacker in the path of nearly all the victim’s traffic — similar in effect to ARP spoofing, via a different mechanism.
How is it prevented?#
| Control | Effect |
|---|---|
| DHCP snooping | Only trusted ports may send DHCP replies |
| Port security | Limit which devices attach where |
| Segmentation | Contain the reachable clients |
| Encryption (TLS) | Interception yields ciphertext |
DHCP snooping is the direct fix: the switch only accepts DHCP server responses from designated trusted ports and drops them everywhere else.
DHCP spoofing is a link-layer man-in-the-middle enabler. More at the Network Security hub.
Frequently asked questions#
What is DHCP spoofing?
DHCP spoofing is a local-network attack where an attacker runs a rogue DHCP server that answers clients’ address requests faster than the legitimate one. The rogue server hands out malicious settings — such as an attacker-controlled default gateway or DNS server — routing the victim’s traffic through the attacker for interception.
How do you prevent DHCP spoofing?
DHCP snooping, a switch feature, is the primary defense: it designates which ports may send DHCP server responses (trusted ports) and drops server replies from all others, so a rogue server on an untrusted port is ignored. Port security and network segmentation add further protection.