What is DHCP Fingerprinting?

DHCP Fingerprinting is a technique for identifying the requester of a DHCP lease. This process is linked to getting an IP address on a network. DHCP Fingerprinting is performed through the analysis of the DHCP exchanged frames and their content.

It can be useful to know a bit more about the type of device connected on the network in order to perform audits, security analysis or reporting. DHCP fingerprinting cannot be considered as foolproof, as anyone can forge DHCP frames with erroneous information, without impacting the process of providing an IP address.

As a reminder, a DHCP transaction is composed of multiple exchanges, generally known as the DORA process, named after the type of frame exchanged (for Discovery, Offer, Request and Acknowledge). In the DHCP frames sent by the client to the network, the protocol requires provision of lots of the information contained in DHCP options.

Most of the systems performing DHCP fingerprinting use the option 55 (Parameter Request List) as the main discriminant. Option 55 is included in the client queries and requests the DHCP server to provide back a set of information in order to perform most of its configuration. The order and the list of the parameters can be considered as a fingerprint.

For extra precision and to limit mismatches as much as possible, DHCP fingerprinting can also use other valuable information provided during DORA. The Client Identifier (generally its MAC address) can be compared to the MAC address OUI database (Organizationally Unique Identifier) which provides information on the vendor of the network interface. In addition, the Vendor Class Identifier can be analyzed as it generally provides more information about the system running on the client device, including its version number. And we can also use the claimed name of the device – it happens that the default configurations of devices use a factory setting, which if not changed can be used to refine analysis. The name is important for IoT fleets that are deployed without much configuration from the beginning.

By using a rich combination of all these criteria being transported in the DHCP frames (in clear), it becomes possible to identify with relatively high precision the type of device asking for an IP address on the network. What can be performed by a DHCP server can also be possible with a sniffer device plugged on the same broadcast domain as the client and just listening to broadcast traffic.

Once the kind of device is known and stored in the IPAM system, I&O teams can use this information to apply business rules and specific automation, perform security enforcement, and enable accounting or device inventory.