New DHCP Server Activity

DHCP servers dynamically assign an IP address and network parameters to network devices, helping IT administrators manage their network infrastructure. An attacker can install a device on a network to act as a rogue DHCP server. When a client sends a broadcast DHCP request for a new IP address, the rogue DHCP server responds with a malicious IP address, gateway, or DNS server that points to an attacker-controlled MITM server. As a result, devices on the network that want to communicate with the client send their traffic to the MITM server instead, enabling the attacker to intercept and collect sensitive data from that traffic.