MNDP and DHCP Attacks and Prevention

What it is

MNDP and DHCP are helpful local protocols that attackers can abuse because they trust everyone on the segment.

MNDP is the MikroTik Neighbor Discovery Protocol. Routers use it to announce themselves to their neighbours.

DHCP hands out addresses, gateways and DNS servers. A rogue server or a flood of requests can break it.

How it works

Each attack uses a trusted broadcast on the local segment, and each has a direct defence.

MNDP attacks

MNDP sends periodic announcements that carry the router identity, the RouterOS version, the board type, the MAC address and the IP address. The protocol uses UDP port 5678.

An attacker on the same segment learns exactly what to attack and which known weaknesses apply. This is the reconnaissance step described in the Introduction chapter.

The router also listens to neighbours. Discovery is useful for admins, so the fix is to turn it off where it is not needed.

/interface list add name=LAN
/interface list member add list=LAN interface=bridge
/ip neighbor discovery-settings set discovery-interface-list=LAN
/tool mac-server set allowed-interface-list=LAN
/tool mac-server mac-winbox set allowed-interface-list=LAN

Older RouterOS versions have a per interface setting instead of an interface list. The idea is the same. Allow discovery on trusted interfaces only, and never on the WAN.

Rogue DHCP servers

A rogue DHCP server is any device that answers DHCP requests without permission. It may be a home router plugged in by mistake, or an attacker on purpose.

A rogue server can offer its own address as the gateway. All client traffic then passes through the attacker, who can read it. This is a man in the middle attack.

DHCP starvation

In a starvation attack the attacker sends many DHCP requests, each with a different fake MAC address. The server gives away every address in its pool, so real clients get none.

The attacker often then runs a rogue server to give the starved clients its own settings. Starvation is therefore both a denial of service and a first step to a man in the middle.

Defences

DHCP snooping

DHCP snooping is a feature of the bridge. It accepts DHCP server messages only from ports marked as trusted.

/interface bridge set bridge1 dhcp-snooping=yes add-dhcp-option82=yes
/interface bridge port set [find interface=ether1] trusted=yes

Here ether1 is the port that leads to the real DHCP server. A server reply from any other port is dropped.

DHCP alert

The DHCP alert listens on an interface and warns you when an unknown server answers.

/ip dhcp-server alert add interface=bridge1 valid-server=AA:BB:CC:DD:EE:FF on-alert="/log warning rogue-dhcp"

The valid-server setting is the MAC address of the real server. The alert only warns. It does not block, so combine it with snooping or a bridge filter rule.

Limiting starvation

If you know your clients, hand out addresses only to them. Use static leases and an address pool that cannot give out anything else.

/ip dhcp-server lease add address=192.168.88.50 mac-address=AA:BB:CC:00:00:01 server=dhcp1
/ip dhcp-server set dhcp1 address-pool=static-only add-arp=yes
/interface bridge set bridge1 arp=reply-only

With add-arp=yes the server adds an ARP entry for each lease, and arp=reply-only makes the bridge answer only for those entries. Hosts without a lease then cannot easily use the network.