DHCP.

The Dynamic Host Configuration Protocol, specified in RFC 2131 for IPv4 and RFC 8415 for IPv6 (DHCPv6), automates IP address assignment and the distribution of network parameters such as subnet mask, default gateway, DNS servers, NTP servers, and PXE boot options. The classic exchange is DORA — Discover, Offer, Request, Acknowledge — carried over UDP ports 67 (server) and 68 (client).

sequenceDiagram
  participant C as Client
  participant S as DHCP server
  participant R as Rogue server
  C->>S: DHCPDISCOVER (broadcast)
  R-->>C: DHCPOFFER (rogue, faster)
  S->>C: DHCPOFFER (legitimate)
  C->>R: DHCPREQUEST (accepts first/rogue)
  R-->>C: DHCPACK + attacker DNS/gateway
  Note over C,R: Victim now routes via attacker

Because the original protocol has no authentication, two attacks dominate. In a rogue DHCP attack, a hostile server races the legitimate one to answer DISCOVER messages and hands out attacker-controlled gateway or DNS values, enabling on-path interception. In DHCP starvation, a tool such as Yersinia floods DISCOVERs with spoofed MAC addresses to exhaust the address pool, often as a setup for the rogue server. RFC 3118 defined message authentication but is essentially undeployed. Practical mitigations live on the switch: DHCP snooping marks trusted uplink ports and builds a binding table of legitimate IP/MAC/port tuples; that table then feeds Dynamic ARP Inspection and IP Source Guard. Combine these with port security to cap MAC addresses per port and 802.1X-based admission control.