Monitoring Unused IP Addresses on Segments Managed by DHCP

摘要

New threats are constantly appearing on the Internet. System administrators have developed many tools to try to mitigate those threats, however, currently available countermeasures are still limited. Moreover, it is difficult for system administrators to fully understand what happens in their networks in (near) real time. We focus on the monitoring of network traffic sent to unused IP addresses with honeypot devices to capture information about network activity. More precisely, we consider ways of handling such unused addresses on network segments managed via DHCP (Dynamic Host Configuration Protocol). In this paper, we propose to exploit that DHCP service to dynamically assign unused IP addresses to honeypot devices, and, discuss the design of such monitoring system.