Protect your Network from DHCP Starvation Attacks using MikroTik RouterOS

[@majhazihamdani7604]

بارك الله فيك . للامانه عمل دروب لااشياء كثيره مش عارف من وين بتدخل . بل المختصر عمل تصفيه للانترنت الداخل من جهاز الدمج

[@MikhailRabinkov]

I was trying to use Bridge filter to block traffic between 2 devices on the network. Both devices connected to port 2 and port 4 on the same router. I've used very similar rules to what you've used but It doesn't seem to work. There is no traffic flow showing in the filter rule. What could be an issue?

[@cinemax6557]

Good

[@mnoquiao]

does this mean that if I have 200+ devices I need to set each of their MAC into the Switch?

[@muhammedahmed9137]

thanks

[@florinalexe6951]

The DHCP server is used by default to dynamically assign IP addresses to unknown devices on the local network. With your rule you block ALL network traffic (not only dhcp requests) between unknown devices and the router and allow traffic ONLY FOR KNOWN hosts. So what's the point? Will you make a list of all known Mac addresses of the hosts? Don't you think it's easier to use static addresses instead of creating lists of known MAC addresses? OK, you can use "mac address sticky" and permit only 1 MAC address on an interface but, like I said, you will block ALL network traffic not only dhcp request. (On Cisco Switches interface will be in "error disable state").

[@MAICT]

This is same as sticky on Cisco, however on MikroTik there is no error disable

[@kainblock]

This is not useful at all. It's almost the same like disabling the DHCP and use only static IPs. The real world scenario is take place on Public networks with many unknown devices.

[@ОТкач-ж8н]

thanks