BAD_ADDRESS FLOOD IN WINDOWS DHCP SERVER

How a single misbehaving client can take down your network

Well, not really your entire network but definitely DHCP. I came across a linux client that had issues with assigning an IP address using dhclient. The dhclient process would throw a null pointer exception during the phase in which it attempts to validate the assigned IP address. From here, dhclient sends a DHCPDECLINE message to the server. The DHCPDECLINE message tells the server that something is either wrong with the DHCP parameters or that the client discovered that the IP was in use (through gratuitous ARP or in this case, a failed attempt at sending a gratuitous ARP).
cat /var/log/messages :
dhclient-null pointer
RFC 1541 states:
“If the server receives a DHCPDECLINE message, the client has discovered through some other means that the suggested network address is already in use. The server MUST mark the network address as “not allocated” and SHOULD notify the local system administrator of a possible configuration problem.”
Looking at my Windows DHCP server console, it’s not a pretty sight. The entire pool is exhausted.
bad_address
Manually deleting the BAD_ADDRESS entries fixes it for only a few seconds.
Here is the Wireshark output immediately after deletion of the BAD_ADDRESS entries:
server-dhcp-decline
You can see that the linux client is just going nuts. Requesting and declining all IP addresses in the pool until there is no more. The quick fix in this instance is easy enough; take the linux client off the network or kill the faulty dhclient process and assign a static IP. But how do we ensure that this won’t happen again?

Protect your Network with DHCP Snooping?

Enabling DHCP snooping on your networking gear is a great way to protect against rouge DHCP servers.
To enable DHCP snooping, follow these commands:
3COM switches:
<S5500> system-view
[S5500] dhcp-snooping
[S5500] interface Ethernet1/0/1
[S5500-Ethernet1/0/1] description *** DHCP server ***
[S5500-Ethernet1/0/1] dhcp-snooping trust
Cisco switches:
Sw2>enable
Sw2#conf t
Sw2(config)#ip dhcp snooping
Sw2(config)#ip dhcp snooping vlan 3
Sw2(config)#int f0/24
Sw2(config-if)#description *** DHCP Server ***
Sw2(config-if)#switchport access vlan 3
Sw2(config-if)#ip dhcp snooping trust
When DHCP snooping is enabled, the switch will only forward DHCP DISCOVER packets out trusted ports. Also, taken from Cisco’s documentation:

Comments

Post a Comment

Popular posts from this blog

Siem architecture

What is SIEM?   Security Information and Event Management solutions are a combination of the formerly disparate product categories of SIM (security information management) and SEM   (security event management). SIEM technology provides real-time analysis of security alerts generated by network hardware and applications. The objective: To help companies respond to attacks faster and organize mountains of log data. Security Information and Event Management (SIEM) technologies take part in a crucial role in addressing the compliance, efficiency, and security needs of an enterprise. The central part of SIEM technologies is the ability to collect security data from all the critical assets on a network and present that data as actionable information via a single interface. SIEM solutions come as software, appliances, or managed services. Increasingly, SIEM solutions are being used to log security data and generate reports for compliance purposes.     SIEM Solution    SIEM intelligenc
Read more

SharesFacebookTwitterGoogle+PinterestEmailSumoMe VMware ESX – “Unable to access a file since it is locked

Image
After transferring and/or trying to restart a VM in ESX you may be presented with the error message “Unable to access a file since it is locked”. Now what you need to do is work out what is actually locking this file and then (unsurprisingly) find a way to unlock it. Generally the problem will be caused by one of three things. 1.  Process Lock:  There is a process on the ESX server that still has hold of a file(s) used by the VM.  This is one of the most common causes.  To resolve this there have been a couple of good VMware Forum postings  here  and  here  that have been consolidated to  this useful posting over  at  GabesVirtualWorld.com   (*Note: It is worth checking out the comment by Kent at the bottom of the posting).  Also, check out Tecumseh’s posting  here . 2.  Disk Naming Conflict:  Two or more disks with the same VMDK name. This can be caused by another disk with the same VMDK file name being referenced by the VM.  This may have occurred due to a VM move where the
Read more

ESXI REMOVE ALL SNAPSHOTS HANGS AT 99%

Image
Check and make sure that the process is actually stuck and not just taking a very long time. To do this, follow these steps: 1. Make sure SSH service is running on the ESXi host Navigate to configuration -> security profile -> services -> Click on Properties Choose the ‘SSH’ service, ‘Options’, and click ‘Start’ Once SSH is enabled, connect to the ESXi host using your favorite ssh client. 2. Run ->   vim - cmd  vmsvc / getallvms Find the vmid of the virtual machine, in this case its 20. 3. Now run ->   vim - cmd  vmsvc / get . tasklist   20 <-   this is the # of the vm from above 4. Find the removeallsnapshots task # then run: vim - cmd  vimsvc / task _ info   185720854  <- this # will be different for you If you see:   “The object has already been deleted or has not been completely created”  or similar, your snapshot removal is probably frozen, but in order to be sure, let’s look at the file sizes and make sure nothing is changing. 5. cd i
Read more