Re: [dhcwg] [Int-area] DHCPv6 router option

[Danny Mayer <mayer at ntp.org>]

Frank Sweetser wrote:
> John Jason Brzozowski wrote:
>> Frank,
>>
>> Are you suggesting we specify a way in DHC to prevent people from
>> improperly
>> configuring their DHCPv6 servers?
> 
> Not at all.  I run a network full of students, so I'm thoroughly aware
> of the futility of assuming that all of your clients are well behaved
> ones =)
> 
> My point simply was that, in any network full of untrusted hosts, there
> are multiple ways for a rogue DHCP server to cause network problems,
> regardless of the existence or lack of a router DHCPv6 option.  If
> you're at all concerned about rogue DHCPv6 servers, then you absolutely
> need some form of switch based "DHCP guard" - a filter applied to all
> edge ports which prevents them from sending out the rogue DHCP
> advertisements.
> 
> So in other words, with or without the DHCPv6 router option, you still
> have to spend the time on a DHCP guard or you're going to be vulnerable
> to rogue DHCP servers.
> 

There's already a virus in the wild that is doing this. See
Trojan.Flush.M. In fact Googling for this shows that there is a new
version out:
http://arstechnica.com/security/news/2009/03/new-version-of-dns-server-trojan-flushm-spotted-in-the-pipe.ars

Though this is more about using DHCP guard everywhere.

Danny


-- 
This message has been scanned for viruses and
dangerous content by MailScanner, and is
believed to be clean.