Controller-less WLANs

How do we validate and fix malformed DHCP packets? How to configure and troubleshoot it in Aruba Instant?

Aruba Employee

This article will have a focus on understanding, enabling and verifying the feature "Fix Malformed DHCP” on the Aruba Instant Access Points running Aruba Instant 6.2.1.0-3.3.0.0 Software.

DHCPv4, the Dynamic Host Configuration Protocol for IPv4, allows a device attached to the network to automatically learn some or its entire network configuration, including its IP address. Most operating systems include DHCP client software.

DHCP has eight types of packets. They have the same format, but the values of some fields in the packets are different.

A typical DHCP packet structure:
 

rtaImage.gif

Malformed DHCP packets are those which either have an empty or an incorrect value in fields of a DHCP packets, Malformed DHCP packets may arise in the network due to software glitches on the client as well as on the DHCP server side and there are also occasions where a malformed DHCP packet is generated by an attacker to deplete the DHCP pool of the server or DOS attack a resource which doesn’t have a capability  to process a malformed DHCP packets like generating a number of malformed DHCP packets that cannot be purged from an interface queue and will result in loss of availability for the interface when the queue fills and is unable to process new packets.
 

Besides preventing the device from obtaining an IP address, this behavior is a problem for several reasons:
  • The ongoing retries unnecessarily raises the workload for DHCP servers. On a large network with many clients, this can degrade or disrupt DHCP service.
  • The ongoing retries unnecessarily raises the broadcast packet rate on the network. On a network with a significant number of affected devices, excessive broadcast traffic degrades (and can disrupt) service.

 Aruba Instant mitigates and fixes Malformed DHCP packets when the feature Fix malformed DHCP is enabled 

If the dhcp-mac and eth-dst-mac fields of the DHCP offer and Acks packet don’t match and client is not in the AP’s association table, then AP will fix the DHCP frame by putting the dhcp-mac as the eth-dst-mac and send it upstream

 

Note: - Malformed Discover and Request DHCP packets are dropped preventing a client from submitting multiple DHCPrequests with different hardware addresses, thereby preventing DHCP pool depletion.

 

A DHCP Offer packet capture where Ethernet Source MAC and client MAC address are different

 

rtaImage.png

 

The configuration and verification steps mentioned in this article are tested on IAP 105 running 6.2.1.0-3.3.0.0.

Environment : This article applies to all the IAPs running a minimum OS version of 6.2.1.0-3.3.0.0.

 

You can configure Fix Malformed DHCP using Instant UI or CLI.

 

In the Instant UI

 

1. Click the Security link at the top right corner of Instant main window.

 

2. Click the Firewall Settings tab. The Firewall Setting tab contents are displayed.

 

3.  Select the following check box:

 

     - Fix Malformed DHCP

 

4. Click OK.

rtaImage (1).png

 

In the Instant CLI

 

(Instant Access Point)(config)# attack

 

(Instant Access Point)(ATTACK)# fix-dhcp-enable

 

(Instant Access Point)(ATTACK)# end

 

(Instant Access Point)# commit apply

 

 

To view the configuration status:

(Instant Access Point)# show attack config

 

Current Attack

 

   --------------

 

Attack      Status

 

 ------       ------

 

drop-bad-arp    Enabled

 

fix-dhcp           Enabled

 

poison-check     Enabled

 

 To view the attack statistics

 

(Instant Access Point)# show attack stats

 

attack counters

 

--------------------------------------

 

Counter                                             Value

 

-------                                               -------

 

 

 

arp packet counter                                10

 

drop bad arp packet counter                    2

 

dhcp response packet counter                 15

 

fixed bad dhcp packet counter                 1

 

send arp attack alert counter                  3

 

send dhcp attack alert counter                0

 

arp poison check counter                        0

 

garp send check counter                         0

 

 

 

Version history
Revision #:
1 of 1
Last update:
‎07-04-2014 04:49 PM
Updated by:
 
Labels (1)
Contributors
Search Airheads
cancel
Showing results for 
Search instead for 
Did you mean: 
Is this a frequent problem?

Request an official Aruba knowledge base article to be written by our experts.