What is DHCP Spoofing?

DHCP spoofing is a network attack in which a rogue Dynamic Host Configuration Protocol (DHCP) server responds to client requests and provides unauthorized or malicious network configuration settings. Instead of receiving configuration details from the legitimate DHCP server, a client may accept configuration from the rogue server, potentially redirecting traffic or disrupting network communication.

Attackers typically perform DHCP spoofing from a network position that allows a rogue DHCP server to deliver unauthorized DHCP offers to clients. Depending on the network configuration and the settings supplied, the attack may enable traffic interception, DNS manipulation, denial of service, or additional attacks against connected devices.

How does DHCP spoofing work?

When a device joins a network, it broadcasts a request for network configuration using DHCP. During a DHCP spoofing attack:

• A rogue DHCP server sends an unauthorized configuration offer in response to the client’s request.
• If the client selects the rogue server’s offer, it requests and applies the unauthorized configuration.
• The rogue DHCP server supplies settings such as an IP address, subnet mask, default gateway, or DNS server.
• The unauthorized configuration may redirect traffic through attacker-controlled infrastructure, direct DNS queries to a malicious resolver, or disrupt normal network communication.

Depending on the configuration applied, attackers may attempt man-in-the-middle attacks, monitor unencrypted traffic, or deny access to legitimate network resources.

DHCP spoofing vs DHCP starvation

How can organizations prevent DHCP spoofing?

Organizations can reduce the risk of DHCP spoofing by combining network security controls with endpoint management.

Common defenses include:

• Enable and properly configure DHCP Snooping on supported managed switches to filter unauthorized DHCP server messages.
• Use network segmentation together with access controls to limit the broadcast domains and resources that unauthorized devices can access.
• Secure switch ports with authentication technologies such as IEEE 802.1X where appropriate.
• Monitor networks for unauthorized DHCP servers and unexpected configuration changes.
• Use properly authenticated encryption, such as HTTPS, SSH, or appropriately configured VPNs, to help protect supported traffic if network routing is manipulated.

A layered security strategy helps reduce the likelihood and impact of DHCP-based attacks.

How Hexnode strengthens endpoint security

With Hexnode, administrators can:

• Configure supported security policies on Windows, macOS, Linux, Android, iOS, and ChromeOS devices, with capabilities varying by platform and enrollment method.
• Deploy documented Wi-Fi, VPN, certificate, restriction, and device settings on supported platforms.
• Deploy operating system patches for supported Windows and macOS devices and use platform-specific update controls where available on other operating systems.
• Monitor supported compliance conditions and perform available remote management actions on enrolled devices.

By helping administrators manage device configurations and compliance, Hexnode complements broader network security controls such as DHCP Snooping and network access control.