NAME¶

dhcpig - DHCP exhaustion script using scapy network library

SYNOPSIS¶

dhcpig [options] <interface> dhcpig -h|--help

DESCRIPTION¶

DHCPig initiates an advanced DHCP exhaustion attack. It will consume all IPs on the LAN, stop new users from obtaining IPs, release any IPs in use, then for good measure send gratuitous ARP and knock all windows hosts offline.

When executed the script will perform the following actions:

Grab your Neighbors IPs before they do
Listen for DHCP Requests from other clients if offer detected, respond with
request for that offer.

Request all available IP addresses in Zone
Loop and Send DHCP Requests all from different hosts MAC addresses

Find your Neighbors MAC IP and release their IP from DHCP server
ARP for all neighbors on that LAN, then send DHCPReleases to server

Finally the script will then wait for DHCP exhaustion, (that is no received DHCP OFFERs for 10 seconds) and then

Knock all Windows systems offline
gratuitous ARP the LAN, and since no additional DHCP addresses are available these windows systems should stay offline. Linux systems will not give up IP even when another system on LAN is detected with same IP.

OPTIONS:¶

The options of DHCPig are the following. For each option, the default value or default behavior is set between parenthesis.

-h, --help
show this help message and exit

-v, --verbosity
Set verbosity level. Can be set to:
0 ... no (3)
1 ... minimal
10 ... default
99 ... debug

-6, --ipv6
DHCPv6 (off, DHCPv4 by default)

-1, --v6-rapid-commit
enable RapidCommit (2way ip assignment instead of 4way) (off)

-s, --client-src
a list of client macs 00:11:22:33:44:55,00:11:22:33:44:56 (Default: <random>)

-O, --request-options
option-codes to request e.g. 21,22,23 or 12,14-19,23 (Default: 0-80)

-f, --fuzz
randomly fuzz packets (off)

-t, --threads
number of sending threads (1)

-a, --show-arp
detect/print arp who_has (off)

-i, --show-icmp
detect/print icmps requests (off)

-o, --show-options
print lease infos (off)

-l, --show-lease-confirm
detect/print dhcp replies (off)

-g, --neighbors-attack-garp
knock off network segment using gratious arps (off)

-r, --neighbors-attack-release
release all neighbor ips (off)

-n, --neighbors-scan-arp
arp neighbor scan (off)

-x, --timeout-threads
thread spawn timer (0.4)

-y, --timeout-dos
DOS timeout (8) (wait time to mass grat.arp)

-z, --timeout-dhcprequest
dhcp request timeout (2)

-c, --color
enable color output (off)

HISTORY¶

June 2017, Man page originally compiled by Philippe Thierry (phil at reseau-libre dot com)