DHCP
DHCP in Nzyme
DHCP is used to enrich asset inventory data. Additionally, all recorded DHCP traffic can be inspected and analyzed under the DHCP tab on the Assets page.
DHCP Fingerprinting
Nzyme is building DHCP fingerprints to detect spoofing. The fingerprints can be viewed in the DHCP data section of the web interface and spoofing alerts can be configured in the Settings tab if the user has required permissions to do so.
A DHCP fingerprint should not be considered unique to a device or device type, because it is very possible to see the same fingerprints across different device types. However, fingerprint detection adds another layer of data that helps to detect spoofing.
DHCP Transaction Types
Configuration
The most important DHCP configuration takes place in your Nzyme tap configuration files:
| Variable | Description |
|---|---|
pipeline_size |
The tap process moves data internally using in-memory pipelines. You may have to increase this value if you experience high throughput of DHCP segments. |