Core network servicesUDP 67, 68 Cleartext by default
Port 67, 68: DHCP
Dynamic Host Configuration Protocol
Hands out IP addresses, gateways and DNS servers. Servers listen on 67, clients on 68. There is no authentication.
How attackers abuse it
- Rogue DHCP servers setting a malicious gateway or DNS server (man in the middle).
- DHCP starvation exhausting the address pool.
How to defend it
- DHCP snooping on switches with trusted ports for real servers.
- Port security to limit MAC addresses per port.
Exam tip
DHCP snooping is the switch control that stops rogue DHCP servers; it also feeds dynamic ARP inspection.