Rogue DHCP Server.

An unauthorized DHCP server connected to a network that hands out IP configurations to clients, intentionally or accidentally redirecting traffic to attacker-controlled infrastructure. It belongs to the Attacks & Threats category of cybersecurity.

An unauthorized DHCP server connected to a network that hands out IP configurations to clients, intentionally or accidentally redirecting traffic to attacker-controlled infrastructure.

A rogue DHCP server is any DHCP service that operates on a network without authorization. It can be malicious (a Raspberry Pi planted in a meeting room, a virtual machine on a compromised host, or a router brought from home) or simply a misconfigured device. Because clients accept the first DHCPOFFER they receive, the rogue server can dictate gateway, DNS, NTP, WPAD, and other options, enabling MITM, DNS hijacking, and credential capture. Rogue DHCP is often the second stage after DHCP starvation. Defenses: DHCP snooping defining a trusted port for the legitimate server, RA Guard for IPv6, network access control (802.1X) before any DHCP traffic, and continuous discovery scans for unexpected DHCP responders.

Defences for Rogue DHCP Server typically combine technical controls and operational practices, as detailed in the full definition above.

Common alternative names include: Unauthorized DHCP server, Malicious DHCP.