Your staging DHCP server sits on the office VLAN: how does a client tell its lease from a rogue's?

## The client is not a judge When a host solicits configuration, it is not evaluating a claim; it is filling in blanks. It broadcasts, it receives, and it uses the first answer that parses and is acceptable. There is no server identity in that decision. No secret is shared in advance, no signature is verified, no client ships with a list of servers it is willing to believe, and nothing in the exchange lets a host prefer the answer that comes from the machine its owners bought. This is not an oversight: bootstrap configuration must work for a device that knows nothing at all, and anything a client could check would have to be configured into the client first, which is precisely the problem being solved. The direct consequence is the one candidates miss. **Maliciousness is not a property of the packets.** A staging server that a network administrator left on the wrong VLAN over a weekend emits the same class of message, gets accepted by the same rule, and reconfigures the same hosts as an attacker's laptop. The hosts cannot separate them because there is nothing to separate them by. Whether an event is an intrusion or a Friday-afternoon mistake is a fact about ownership and intent, held entirely off the segment. ## What differs, and why you cannot lean on it Attackers do tend to leave asymmetries, and it is worth being able to list them while being clear that each is optional: - **A very short lease.** An attacker who wants hosts to come back to them soon can hand out a lease measured in minutes rather than hours. Nothing requires it; a longer one holds the position just as well and looks perfectly ordinary. - **Answering fast.** First acceptable answer wins, so an attacker answering from a laptop on the same segment is often quicker than a server several hops away. But a staging server sitting on the same segment as the clients is also nearer than the production one, and so is also quicker. - **An address or gateway outside the real ranges.** An attacker who does not know the estate's addressing hands out something that does not fit. An attacker who spent ten minutes watching the segment hands out something that fits perfectly - and a staging server configured for a lab range hands out something that fits nothing at all. Every one of these can be absent from a real attack and present in a benign one. Treating any of them as the definition of "rogue" gets the direction of the claim backwards. ## The same shape on the other route This is not peculiar to configuration answers. Claiming to own an address on the wire has a legitimate twin too: a high-availability pair failing over announces that a virtual address has moved to a new hardware address, which is on the wire an assertion that this machine now owns an address it did not own a second ago. A misconfigured duplicate address produces a similar contest. The property that makes takeover possible - an unauthenticated claim that the segment believes - is exactly the property that makes legitimate movement possible, and therefore the property that makes the two indistinguishable at the point of receipt. ## What this means for how you talk about it Three things follow, and they are what an interviewer is listening for. First, **the wire cannot classify intent**, so any confident statement of the form "this traffic was an attack" is really a statement about provenance: which port, which device, whose change, authorised or not. On an authorised on-site assessment whose brief permits first-hop takeover and nothing else, the assessor's traffic is by construction identical to the thing it is imitating - that is the point of the exercise. Second, **the fix is not a better check in the client.** A client that could tell the difference would need to have been told, in advance and by some trusted path, which servers to accept - which is a segment-level arrangement, not a protocol nicety. Third, **a benign true positive is still a finding.** A staging server on the wrong VLAN is not an attack, but it demonstrates, with evidence, that any device on that segment could have done the same thing. The organisation learned the exposure is real without paying for an intruder to prove it, and the honest reading of the event is that the segment - not the administrator - is what needs changing.