How to avoid DHCP starvation attack

  Security

DHCP(Dynamic host configuration protocol) is responsible for providing the IP addresses to hosts and it provides IP address for a particular lease and they are issued for some lease time which can vary according to DHCP server setting but usually it is one week.DHCP starvation is inability of DHCP server to issue IP addresses to legitimate users because attacker machines requests so many IP addresses as a result DHCP server runs out of IP addresses.In order to avoid such type of attack we can specify which ports are trusted and which one are un-trusted plus rate limit can be applied.Only DHCP request will be received on trusted ports while on untrusted ports DHCP requests will be ignored it will not allow any DHCP response (ACK ,Response)on these ports.

Switch(config)# ip dhcp snooping
switch(config)# interface ethernet 1/1/1
switch(config-if)dhcp snooping trust

In order to make any port untrusted just put dhcp snooping untrust instead of dhcp snooping trust
By Applying this machanism only devices connected to trusted ports will be able to get IP address from DHCP server.