Rogue DHCP attacks exploit the trust that devices place in DHCP servers. DHCP automatically provides network configuration such as IP address, gateway, DNS server, and domain settings. If an attacker sets up a fake DHCP server, they can give victims malicious network parameters that redirect traffic, enable MITM attacks, or cut access to legitimate resources. Rogue DHCP is one of the most powerful internal network takeover techniques.

How DHCP Works

When a device joins a network, it broadcasts:

1. DHCP Discover

2. DHCP Offer

3. DHCP Request

4. DHCP Ack

Whichever DHCP server responds first usually wins.
A rogue DHCP server exploits this by responding faster than the real one.

What Rogue DHCP Can Do

A rogue DHCP server can:

• Assign a malicious default gateway

• Assign a malicious DNS server

• Redirect all traffic through the attacker

• Force victims into MITM

• Redirect internal traffic to attacker devices

• Assign invalid configurations to disrupt the network

• Push victims into fake networks or VLANs

This allows large-scale interception with little effort.

Preparing for a Rogue DHCP Attack

Before running a rogue server, the attacker must:

• Identify the subnet

• Identify the real gateway

• Identify active hosts

Discovering Network Information

ip a

ip route

sudo arp-scan -l

These commands reveal IP ranges, routers, and active devices.

Rogue DHCP with Ettercap

Ettercap includes DHCP poisoning capabilities.

Starting Ettercap Rogue DHCP

sudo ettercap -T -q -M dhcp:spoof

Ettercap begins sending DHCP offers with attacker-defined values.

Editing Ettercap DHCP Settings

sudo nano /etc/ettercap/etter.conf

You can set:

• Fake gateway

• Fake DNS server

• Fake IP ranges

Victims receive attacker-controlled settings.

Rogue DHCP with Yersinia

Yersinia is a network attack tool that supports DHCP manipulation.

Starting Yersinia (Interactive)

sudo yersinia -I

Inside Yersinia, select:

DHCP → Launch Attack → Rogue DHCP

It continually sends DHCP offers.

Rogue DHCP with Bettercap

Bettercap automates DHCP spoofing.

Launching Bettercap

sudo bettercap -iface eth0

Enabling DHCP Spoofing

set dhcp.spoof.ip 10.10.10.100
set dhcp.spoof.router 10.10.10.1
set dhcp.spoof.dns 10.10.10.50
dhcp.spoof on

Victims now receive attacker-controlled DHCP replies.

Rogue DHCP with DHCP Starvation

By exhausting the real DHCP server’s IP pool, attackers force devices to accept IPs from the rogue server.

DHCP Starvation

sudo dhcpstarv -i eth0

This creates many fake DHCP requests, consuming all available IPs.

Once the legitimate DHCP server has no addresses left, the attacker supplies their own via rogue DHCP.

Post-Exploitation After Rogue DHCP

Once victims use the attacker’s DHCP configuration, the attacker can:

• Perform ARP spoofing

• Perform DNS spoofing

• SSL strip

• Log all HTTP traffic

• Redirect to phishing sites

• Force VPN or proxy routes

• Capture plaintext credentials

• Intercept SMB, FTP, and email traffic

Rogue DHCP provides complete MITM control over every victim that accepts the configuration.

Detecting Rogue DHCP Behavior

Pentesters check whether the network uses protections such as:

• DHCP snooping

• Port security

• Trusted switch ports

• VLAN segregation

• 802.1X authentication

Networks without DHCP snooping are highly vulnerable.

Why Rogue DHCP Matters

Rogue DHCP is one of the most powerful internal network attacks. One malicious DHCP server can control entire subnets by assigning fake gateways, DNS servers, and routes. This allows widespread MITM, redirection, credential theft, and traffic interception across the LAN.

Intel Dump

• Rogue DHCP gives attackers control over gateway, DNS, and routing

• Tools include Ettercap, Bettercap, Yersinia, DHCP Starvation utilities

• Enables widespread MITM and packet manipulation

• Stopped by DHCP snooping, VLAN control, and port security