The suitable solution against DoS on DHCP is to filter unnecessary packet in kernel space before it reach DHCP server.<br>Such kernel module do exist. See <a href="http://sscdvp.blogspot.com/2011/11/test.html">http://sscdvp.blogspot.com/2011/11/test.html</a> for more details.<br>
<br>Best regards, Serghei Samsi<br><br><div class="gmail_quote">2012/8/29 Dorsey, Chris <span dir="ltr"><<a href="mailto:dorsey2@llnl.gov" target="_blank">dorsey2@llnl.gov</a>></span><br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div link="blue" vlink="purple" lang="EN-US">
<div>
<p class="MsoNormal">We are seeing a lot of induced IO wait due to processing/logging of unwanted DHCP requests from *<b>known</b>* MAC addresses (broken printers, mis-behaving clients, etc.) and were very interested in this thread. After some hopeful testing
with iptables based on some clues in this thread, we have abandoned this approach after one of our admins discovered the following article confirming that ISC DHCP uses raw sockets which get processed before iptables, rendering iptables-based solutions useless
for these type of problems:<u></u><u></u></p>
<p class="MsoNormal"> <a href="https://deepthought.isc.org/article/AA-00378/0/Why-does-DHCP-use-raw-sockets.html" target="_blank">
https://deepthought.isc.org/article/AA-00378/0/Why-does-DHCP-use-raw-sockets.html</a><u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Our limited testing confirms this fact. Other solutions in this space would seem to be external filtering in front of the DHCP servers (possible), fixing broken clients (valiant but impractical at scale), or enhancing dhcpd with the ability
to allow for administrator-configured filtering. This last one seems the most attractive for several reasons. Any other possible solution approaches?<span class="HOEnZb"><font color="#888888"><u></u><u></u></font></span></p>
<span class="HOEnZb"><font color="#888888">
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal">Chris<u></u><u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
<p class="MsoNormal"><u></u> <u></u></p>
</font></span></div>
</div>
<br>_______________________________________________<br>
dhcp-users mailing list<br>
<a href="mailto:dhcp-users@lists.isc.org">dhcp-users@lists.isc.org</a><br>
<a href="https://lists.isc.org/mailman/listinfo/dhcp-users" target="_blank">https://lists.isc.org/mailman/listinfo/dhcp-users</a><br></blockquote></div><br>