An Effective Technique to Automatically Detect and Neutralize Rogue DHCP Server

Nowadays, Rogue DHCP attack is a crucial attack that provides malicious IP address and other related configurations to DHCP clients and triggers a Man-in-the-middle (MITM) attack. Although most of the existing studies proposed digital certificate based DHCP server authentication, but securing the DHCP server private key become very challenging and risky job. Again the existing DHCP snooping based prevention technique is ineffective if the attacker has physical access to the switch. Moreover, the DCHP server IP address whitelisting based detection could be easily bypassed by IP address spoofing attack. Furthermore, these methods are lacking the technique to neutralize the rogue DHCP server. Therefore, the objective of this research is to propose an effective technique to detect and automatically neutralize the rogue DHCP server using python based detection engine. To achieve this objective, at first, MITM attack and it's consequences has been demonstrated using a rogue DHCP server. Secondly, the study proposed a Python-based rogue DHCP detection and automatically neutralization engine that distinguishes between a malicious rogue DHCP server and a legitimate DHCP server by comparing their whitelisted IP addresses and it's associated MAC addresses. Finally, the effectiveness and validation of the proposed techniques were demonstrated using the Multivendor Network Emulation Software (EVE-NG).