Rogue MAC Spoofing Exhausts DHCP Scope

Question

Randomized MAC requests are exhausting our DHCP scope. How can we configure Name Protection and MAC filtering with PowerShell?

Answer 1

Hello @John Doe

You can configure both DHCP Name Protection and MAC filtering with PowerShell, but it's important to separate their purposes.

Name Protection will not prevent DHCP scope exhaustion caused by randomized MAC addresses. It protects DNS registrations by using DHCID records so that one DHCP client can't overwrite another client's DNS name. Microsoft documents the -NameProtection option on Set-DhcpServerv4DnsSetting for this purpose.

For example, to enable it on a specific scope:

Set-DhcpServerv4DnsSetting -ComputerName "DHCP01.contoso.com" -ScopeId 192.168.10.0 -NameProtection $true

You can verify the effective setting with:

Get-DhcpServerv4DnsSetting -ComputerName "DHCP01.contoso.com" -ScopeId 192.168.10.0

For MAC filtering, Windows DHCP provides separate Allow and Deny lists. You can enable them with:

Set-DhcpServerv4FilterList -ComputerName "DHCP01.contoso.com" -Allow $true -Deny $true

Microsoft documents that Set-DhcpServerv4FilterList controls whether the DHCP server's Allow and Deny MAC-address lists are enabled.

You can then review the existing filters:

Get-DhcpServerv4Filter -ComputerName "DHCP01.contoso.com"

or just the deny list:

Get-DhcpServerv4Filter -ComputerName "DHCP01.contoso.com" ` -List Deny

However, there's an important limitation in your particular scenario.

If the rogue client is generating a new randomized MAC address for every DHCP request, adding individual addresses to the Deny list becomes ineffective because the attacker can simply present another MAC address.

An Allow list is much stronger if the environment is small and tightly controlled because DHCP will serve only explicitly authorized MAC addresses. But this can create substantial administration overhead and can also conflict with legitimate devices using MAC randomization/private addressing.

For an enterprise network, I would address this primarily at the switch/WLAN access layer, rather than relying on DHCP as the security boundary. Depending on your network infrastructure, consider:

• 802.1X/NAC to authenticate devices/users before network access.
• DHCP snooping to control DHCP behavior at the switch layer.
• Port security / MAC limits to restrict how many source MAC addresses can appear behind an access port.
• WLAN controls that prevent or manage unauthorized/private MAC clients.
• Rate limiting or other DHCP protections supported by your switching/security platform.

For immediate containment, also identify which switch port or wireless client is generating the requests. If hundreds or thousands of different MAC addresses are arriving through the same physical access port or AP/client session, that's usually much more actionable than trying to block each generated MAC address individually.

I would also inspect the current lease consumption:

Get-DhcpServerv4Scope | Get-DhcpServerv4ScopeStatistics

and review leases in the affected scope:

Get-DhcpServerv4Lease -ScopeId 192.168.10.0

Be careful about bulk-deleting leases merely to recover addresses. If the rogue source remains connected, it can immediately consume the released addresses again.

So I would use Name Protection for DNS integrity, MAC filtering where appropriate for DHCP admission control, but treat the randomized-MAC scope exhaustion as a network access-control problem. The durable fix is stopping or limiting the offending endpoint before its DHCP requests can repeatedly reach the server.

If you can share whether these requests are arriving from wired clients, Wi-Fi, or both, and whether the network switches/APs support DHCP snooping, 802.1X, or port security, that would help determine the best containment method.

Please "Accept the Answer" if this information helped you. This will help us and others in the community as well.