Rogue DHCP Server Offer Detected on Network
This rule detects a rogue DHCP server offer on the network. It specifically looks for UDP traffic on port 67 (DHCP server port) to the home network, containing the DHCP message type '02' (DHCP Offer) at the beginning of the payload. A threshold is set to trigger an alert if 3 such offers are detected from the same source within 10 seconds, indicating a potentially malicious or misconfigured DHCP server attempting to assign IP addresses.
Suricata
