PAGES
← all tools
◆ Exploitation & C2

dhcpig

2.7.1 open-source

DHCP exhaustion script written in python using scapy network library - kamorin/DHCPig

source ↗ rss ↗ What is a cyber toolchain? last repo push Sep 12, 2026

Summary

dhcpig is an open-source command-line tool for DHCP exhaustion testing, free to use, that floods a LAN's DHCP pool, hijacks neighbours' leases, and evicts hosts from their addresses with forged ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. to see whether the network's defenses catch it. It requires root privileges and Python 3.11+, and can be run either as a CLI (dhcpig exhaust, release, active-scan) or through a bundled local web UI, with a --dry-run mode for recon-only passes and scope limited by CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network.. First committed in 2012, it's still maintained today, with 11 contributors and a release cut just 12 days ago.

DHCP exhaustion script written in python using scapy network library - kamorin/DHCPig

How dhcpig helps

Does this network actually stop issuing new leases once its pool is under pressure?

floods the LAN requesting every address in scope under distinct hosts and MAC addresses, then declares the pool exhausted once no offers arrive for 10 straight seconds, showing whether the DHCP server ran dry

Can an attacker on this LAN quietly take over a neighbour's address?

listens for DHCP offers meant for other clients and answers first, taking the lease for itself, so it shows whether the network lets a stranger grab an address that was already handed out

Are the hosts on this segment still up once their leases are pulled?

releases neighbours' IPs from the server and sends forged ARP across the LAN, then reports whether Windows hosts drop offline while Linux hosts hold their address anyway

Would a hardening change actually be caught, or does the network stay blind to this?

runs a read-only pass that ARP-sweeps and exchanges only control transactions, sending nothing that mutates a lease, so the same reconnaissance can be repeated before and after a defense change to compare

Which addresses in my range were actually touched by a run, and can I put them back?

the run's report lists every host and lease it claimed, and a reversal replays that record to release them, undoing the exhaustion without a second manual survey

Is this test confined to the subnet I meant to hit?

bounds every discovery, request, and release to the CIDR ranges given for that run, defaulting to the interface's own network if none is set

all 8 features, with the evidence for each →

Languages

Not documented

Features

8 capabilities · 4 backed by code, an API document or a real run

Built from dhcpig's releases, docs, README and our own runs. “Seen” marks the month we first spotted a release the vendor didn't date. Group names and tags are our labels.

Compare with peers →

What dhcpig offers you

  • Command-line interface3
  • Python scripting support2
  • Scripting language support1
All capabilities 8 capabilities
DHCP pool exhaustion verified Floods a DHCP server with requests to exhaust its address pool, validating whether the network detects or prevents the attack. 1 release · 4 other sources · first seen Jul 2026

Also counts toward: Command-line interface, Python scripting support

release

  • Adds --scope argument to the exhaust subcommand to bound the ARP sweep and make pool-size estimation deterministic 2.5.0 · Jul 2026 · source · release history

docs

  • 105 lines (80 loc) · 4.85 KB 105 lines (80 loc) · 4.85 KB Whitehat DHCP hardening validation: exhaust a pool, hijack neighbours' leases, evict hosts off their addresses with forged ARP, and report whether the network stopped you. Needs root and Python 3.11+. docs update · Aug 2026 · source
  • DHCP hardening validator that exhausts address pools, hijacks leases, and evicts hosts via forged ARP to test network defenses.

command line

  • --convert — regenerate the database from Satori's fingerprints/dhcp.xml and write it to --database, then exit v2.7.0 · Aug 2026 · command-line history

example

  • Limit the DHCP exhaustion attack to a specific subnet scope for more controlled testing. dhcpig exhaust --scope 192.168.1.0/24 2.5.0 · Jul 2026 · source
HTML report dashboard verified Generates an HTML report of findings and summary results, optionally opening it automatically in a browser. 2 releases · 2 other sources · first seen Aug 2026

Also counts toward: Command-line interface

release

  • Changes dhcpig-web to open a browser by default; adds --no-open flag to opt out 2.7.1 · Aug 2026 · source · release history
  • Expands dashboard graphing to plot four separate transmit-side lines (ARP, DISCOVER, RELEASE, RENEW) instead of merged rates 2.7.1 · Aug 2026 · source · release history

docs

  • 354 Commits on Aug 2, 2026 Merge branch dashboard-pps-ppm-conversion-11c1ab cdeda15 Copy full SHA for cdeda15 docs: add a global-install option, fix stale release-previous description Show description for c63b357 c63b357 Copy full SHA for c63b357 core: release-previous keeps releasing even when the pool isn't… docs update · Aug 2026 · source

command line

OS fingerprint database conversion verified Regenerates the internal fingerprint database from Satori's dhcp.xml source file and writes it to a configurable path. 2 releases · 2 other sources · first seen Aug 2026

release

  • Replaces the bundled packetfence_dhcp_fingerprints.json with satori_dhcp_fingerprints.json to align licenses and update the fingerprint database. 2.7.0 · Aug 2026 · source · release history
  • The script data/fingerprint-merge.py is renamed to data/satori-merge.py, removing the old path. 2.7.0 · Aug 2026 · source · release history

command line

  • --convert — regenerate the database from Satori's fingerprints/dhcp.xml and write it to --database, then exit v2.7.0 · Aug 2026 · command-line history

example

  • Run the new merge script to regenerate the fingerprint data if you need to update the underlying Satori XML source. python3 data/satori-merge.py --convert dhcp.xml 2.7.0 · Aug 2026 · source
Neighbour lease hijacking shipped Attempts to claim addresses already leased to other hosts on the network to test whether the DHCP infrastructure prevents lease theft. 1 release · 2 other sources · first seen Aug 2026

Also counts toward: Python scripting support, Scripting language support

release

  • Introduces new finding CLIENTS_HOLDING_STOLEN_LEASES (FAIL/high) for hosts defending addresses we already hold 2.7.1 · Aug 2026 · source · release history

docs

  • 105 lines (80 loc) · 4.85 KB 105 lines (80 loc) · 4.85 KB Whitehat DHCP hardening validation: exhaust a pool, hijack neighbours' leases, evict hosts off their addresses with forged ARP, and report whether the network stopped you. Needs root and Python 3.11+. docs update · Aug 2026 · source
  • DHCP hardening validator that exhausts address pools, hijacks leases, and evicts hosts via forged ARP to test network defenses.
OS fingerprint database regeneration script shipped Provides a dedicated script to regenerate the OS fingerprint database from the Satori XML source. 1 other source · first seen Aug 2026

example

  • Run the new merge script to regenerate the fingerprint data if you need to update the underlying Satori XML source. python3 data/satori-merge.py --convert dhcp.xml 2.7.0 · Aug 2026 · source
OS identification for discovered hosts shipped Populates database output and roll-call rows with specific OS tags for matched hosts using the Satori data source. 1 release · first seen Aug 2026

release

  • Populates the os field in database output for matched hosts (e.g., Windows 10, iOS 12), enabled by the new Satori data source which separates OS from device info. 2.7.0 · Aug 2026 · source · release history
Verbosity-controlled output verified Lets the user select output detail across four levels, from results-only through packet-level logging to internal debug lines. 1 other source · first seen Aug 2026

Also counts toward: Command-line interface

command line

  • -v — Output detail, 0-3 (default 2). 0 prints results only (findings and the final summary); 1 is a compact one-character-per-packet stream; 2 is the normal packet-level log; 3 adds internal debug lines. v2.6.1 · Aug 2026 · command-line history
Network interface discovery shipped Lists available network interfaces on the host to identify targets for scanning. 1 other source

example

  • List available network interfaces dhcpig ifaces

Lines in monospace are the tool's own words: help text parsed from its source, or an endpoint from its API document. Under release, a line is our summary of a dated release. Under docs, it is quoted from the tool's own documentation or website. Each links back to the source it came from.

Score card

  1. Shipping velocity releases a month, last 12 months
  2. Documentation quality release-notes rubric, 0–100
  3. Breaking-change discipline how rarely a release breaks users, and notice given
  4. Maintenance risk quiet time against its own cadence, maintainers
  5. Innovation & surface new capabilities, API and MCP surface
  6. Community health
  7. Contributor trend distinct committers, this year against last
  8. Maintainer concentration bus factor now against a year ago
  9. Issue backlog trend issues closed per issue opened, 12 months
  10. Responsiveness median time to a maintainer’s first reply

Nine scores for dhcpig, each built from the releases, notes and API history this site tracks — and, on Researcher and Business, where it stands among every measured tool in its category and how that has moved.

Score cards are part of every paid plan.

See plans →

Each score is 0–100 on a published rubric, derived from data this site already shows. A dimension we cannot measure says so — it is never scored 0 and never enters a rank.

How this is scored
  • Shipping velocity — releases a month over the last 12 months, on a log scale where 16 a month scores 100. Needs 3 releases in the window.
  • Documentation quality — the release-notes rubric published on the analytics page, unchanged.
  • Breaking-change discipline — the share of releases carrying a breaking change (none scores 100, half or more scores 0). Only projects that label breaking changes are measured: a clean record cannot be told from an unlabelled one.
  • Maintenance risk — quiet time measured against the tool's own release cadence (quiet longer than 90 days and three typical gaps scores 0), plus the number of active maintainers and whether contributors are growing, where known. Higher is lower risk.
  • Innovation & surface — new capabilities in the feature ledger this year, API and MCP operations added, and the share of commits that are features: the mean of whichever we hold.
  • Community health (open-source tools only) — each is a direction, not a size: contributors this year against last, the bus factor now against a year ago, and issues closed per issue opened, where steady scores 50, doubled 100 and halved 0; plus the median time to a maintainer's first reply (an hour scores about 100, a month or more 0). A commercial card has no repository and carries none of the four.
  • Documented delivery (commercial tools) — when a vendor's documented new capabilities have slowed against its own baseline, that counts against the overall standing as heavily as two low dimensions. Steady delivery, or too little history to judge, leaves the standing alone; it is never a sixth score.
  • Open-source tools are scored on repository signals; commercial tools on their published changelog. Ranks compare tools within one category and one profile and need at least five measured peers; the overall standing needs three ranked dimensions. Best-in-breed or consolidator is a shape, not a quality, and is never scored.

Release-note detail over time

See how much detail dhcpig puts in its release notes, quarter by quarter, and compare it with tracked tools in the same category. This history uses up to ten retained, reviewed notes per tool; sparse or blank older quarters may reflect that limit.

Checking release-note history…

Explore the full chart →

Releases

Show

11 entries

  1. October 20261
  3. September 20262
  5. August 20267
  10. July 20261
    Show

    11 entries

    1. docs update Oct 10, 2026 · issue 101

      DHCPig gains machine-readable CSV/verdict report output for lab and red-team workflows.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

      • Adds machine-readable verdicts to the report module for lab and red-team use.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
      • Adds a dhcpig-web(1) man page alongside the existing dhcpig(1) entry.

      2 details in Everything

    2. docs update Sep 9, 2026 · issue 069

      DHCPig gains dry-run recon, scoped targeting, session reports, CI exit codes, and new subcommands for exhaustion, release, and passive scanning

      └──▷ TRY IT
      Run a full exhaustion test against a specific subnet in CI and fail the pipeline if the segment is found vulnerable.
      $ sudo dhcpig exhaust eth0 --scope 192.168.1.0/24 --report run.json --fail-on fail
[ $? -eq 1 ] && echo 'segment is vulnerable'
      Perform recon-only discovery on a Wi-Fi interface without sending mutating packets, using the real NICNICA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link. MAC to avoid AP frame drops.
      $ sudo dhcpig exhaust wlan0 --dry-run --no-spoof-eth-src --report recon.html
      Passively fingerprint DHCP clients on a segment by watching option-55 order and MAC vendor without sending any traffic.
      $ sudo dhcpig scan eth0
      • Adds --dry-run flag for recon-only mode: ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. sweep and control transactions run without sending any mutating packets.
      • Adds --scope CIDR flag (repeatable) to bound targets to a specific network range, defaulting to the interface's own network.
      • Adds --report FILE flag to write a session report on run completion; format is inferred from the file extension (.json, .csv, or .html, defaulting to JSON).
      • Adds --fail-on LEVEL flag for scripted runs: exits with code 1 when a finding at fail or inconclusive is raised; default is never.
      • Adds --client-mac MAC flag (exhaust only, repeatable) to supply one or more fixed MACs instead of random ones, rotating through the list.
      +11 more show less
      • Adds --request-option SPEC flag for exhaust/active-scan to control DHCP option-55 (parameter-request-list) content, e.g. 12,14-19,23.
      • Adds --no-spoof-eth-src flag (exhaust only) to use the real NIC MAC as the Ethernet source, enabling use on Wi-Fi where APs drop frames from unassociated MACs.
      • Adds --no-evict flag to skip the ARP-conflict phase during a run.
      • Adds --rate N flag to set packet-per-second rate (default 7); not applicable to exhaust, which self-paces.
      • Adds exhaust subcommand for full DHCP pool exhaustion: inventories the segment, releases neighbour leases, floods DISCOVER/REQUEST from fabricated MACs, and forges ARP conflicts.
      • Adds release subcommand to release active clients' leases without flooding the pool, then re-requests by name and tests with ARP conflict.
      • Adds release-previous subcommand to replay the on-disk lease journal and return every address the tool previously took, with --max-age filtering for stale entries.
      • Adds active-scan subcommand for read-only ARP sweep plus DHCPINFORM to fingerprint DHCP servers without taking any addresses.
      • Adds scan subcommand for passive read-only monitoring: watches DHCP and ARP traffic, fingerprints hosts by option-55 order or MAC vendor, sends nothing.
      • Adds dhcpig-web command providing a web UI accessible at http://127.0.0.1:8787/?token=....
      • Each finding carries a UTC timestamp and the corresponding MITRE ATT&CKMITRE ATT&CKA publicly maintained knowledge base of adversary tactics and techniques observed in real attacks, maintained by MITRE. Cyber tools use it as a common taxonomy to classify, map, and communicate threat behavior. technique, enabling alignment with defender logs and report templates.

      16 details in Everything

    3. docs update Sep 9, 2026 · issue 069

      dhcpig: Adds --fail-on LEVEL flag (values: fail, inconclusive, never) that exits with code 1 when a finding at the specified level is raised, enabling scripted/CI use.

      └──▷ TRY IT
      Run a scoped exhaustion test against a lab segment and fail CI if the pool is found vulnerable — without touching the rest of the network.
      $ sudo dhcpig exhaust eth0 --scope 192.168.10.0/24 --report run.json --fail-on fail
[ $? -eq 1 ] && echo 'segment is vulnerable'
      Perform a safe, read-only ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. sweep and DHCP server fingerprint on a segment before any destructive testing.
      $ sudo dhcpig active-scan eth0 --scope 10.0.1.0/24 --report scan-results.html
      Recover a previously exhausted pool by replaying the lease journal and returning all addresses the tool took.
      $ sudo dhcpig release-previous eth0 --report recovery.json
      • Adds --client-mac MAC flag (exhaust mode only, repeatable) to rotate through specific MACs instead of random ones.
      • Adds release-previous subcommand for post-exhaustion recovery, replaying the on-disk lease journal ($XDG_STATE_HOME/dhcpig/leases-<iface>.jsonl) to return taken addresses, with --max-age filtering for stale entries.

      2 details in Everything

    4. docs update Aug 3, 2026 · issue 034

      DHCPig 2.7.x adds new eviction techniques, richer OS fingerprinting, and improved roll-call reporting

      └──▷ TRY IT
      Opt out of the new auto-browser behaviour in dhcpig-web when running headlessly or in CI.
      $ dhcpig-web --no-open
      Regenerate the bundled Satori fingerprint JSON from an updated dhcp.xml upstream data file.
      $ python3 data/satori-merge.py --convert dhcp.xml
      • Adds CLIENTS_HOLDING_STOLEN_LEASES (FAIL/high) finding for hosts sitting on server-reassigned leases, replacing the understated CLIENTS_DEFENDED_ADDRESSES outcome.
      • Roll-call rows now include a renewal bound (e.g. fails at next renewal (within ~12h)) derived from the lease duration handed to the attacker.
      • Eviction now sends a third, unicast ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery.-conflict frame per target per round via build_arp_conflict_unicast(), improving success against wireless APs with client isolation.
      • Forged MAC contesting a target is now stable for the entire eviction (one MAC per target across all rounds) instead of being re-rolled each round.
      • Denser conflict rounds: evict_rounds increased from 4 to 6 and timeouts.evict_interval reduced from 3.0 s to 1.5 s, fitting all rounds inside a single 10 s DEFEND_INTERVAL window.
      +10 more show less
      • Pool exhaustion is now surfaced in the OUTCOME block with a pool_exhausted flag alongside leases_acquired, and released_unconfirmed rows escalate to stronger wording when the pool is confirmed drained.
      • Roll-call outcome lines now include a device/OS tag (e.g. [Windows 10 (Microsoft Corp.)]) derived from fingerprinting, rendered in both CLI and web log.
      • dhcpig-web now opens a browser by default; --no-open opts out.
      • Dashboard graph now plots four separate transmit-side lines — ARP, DISCOVER, RELEASE, RENEW — instead of one merged rate, with a new requests_sent counter tracking DHCPREQUEST traffic.
      • Sparkline now graphs DHCPRELEASE pps alongside DISCOVER pps, with a legend; release/release-previous modes previously showed 0 pps.
      • Neighbor now tracks seen_via, and passive-scan outcome text distinguishes hosts observed via ARP from those observed via DHCP.
      • Fingerprinting adds a vendor-class (DHCP option 60) matching tier: 187 exact signatures at confidence 70 (55 when ambiguous), between option-55 and the OUI floor.
      • os field (e.g. Windows 10, iOS 12, ChromeOS) is now populated for fingerprint database matches when all candidates agree on one OS, replacing a hardcoded None.
      • Bundled fingerprint data replaced wholesale: packetfence_dhcp_fingerprints.json (ODbL) swapped for satori_dhcp_fingerprints.json (GPL-2.0-or-later), unifying the project under one license.
      • data/fingerprint-merge.py replaced by data/satori-merge.py, which serves as both a standalone lookup CLI and the converter that regenerates the JSON from Satori's dhcp.xml via --convert.

      15 details in Everything

    5. docs update Aug 3, 2026 · issue 034

      DHCPig gains a richer web dashboard with ppm traffic graph, per-host result column, ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery./DHCP split tracking, and auto-open browser on launch.

      └──▷ TRY IT
      Launch the web dashboard without auto-opening a browser, useful in headless CI or remote environments.
      $ dhcpig-web --no-open
      • Converts the web dashboard and traffic graph from packets-per-second to packets-per-minute (ppm) display.
      • Adds a 4-line traffic graph tracking ARP, DISCOVER, RELEASE, and RENEW rates separately, with pps shown as their sum.
      • Adds an ARP/s dashboard tile and graph line; folds ARP rate into the overall pps counter.
      • Adds a per-host Result column to the neighbors/hosts panel, surfacing pool exhaustion in the OUTCOME view.
      • Splits observed only hosts into two categories: observed via ARP versus observed via DHCP.
      +6 more show less
      • Merges NEIGHBOR SUMMARY into OUTCOME and flags ARP-conflicted rows inline.
      • Adds a released_unconfirmed category and prefixes every release-mode row with a RELEASE-sent indicator.
      • Tags each roll-call row with a short device/OS label for faster fingerprint reading.
      • Scales the traffic graph to a recent time window instead of full session history.
      • Defaults dhcpig-web to opening a browser automatically; adds --no-open flag to opt out.
      • Adds a global-install option documented alongside the existing from-source and .deb paths.

      11 details in Everything

    6. docs update Aug 3, 2026 · issue 034
      └──▷ TRY IT
      Run a full pool-exhaustion test against a segment and save a machine-readable report for post-engagement review.
      $ sudo .venv/bin/dhcpig exhaust eth0 --scope 192.168.4.0/22 --report run.json
      Recon a segment without sending any mutating packets — useful for scoping before a destructive test.
      $ sudo .venv/bin/dhcpig active-scan eth0 --scope 192.168.4.0/22 --dry-run
      After verifying the exhausted state, restore all leases taken in a previous run so the pool is usable again.
      $ sudo .venv/bin/dhcpig release-previous eth0
      • New dhcpig-web command launches a browser-based UI for running and reviewing DHCP hardening sessions (--open auto-opens the browser).
      • New exhaust subcommand performs full DHCP pool exhaustion: ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. inventory, neighbour lease release, DISCOVER/REQUEST flood, re-request by option 50, and ARP conflict forging.
      • New release subcommand evicts currently active clients (inventory → release → re-request → ARP conflict) without flooding the pool.
      • New --report FILE flag writes a session report on completion; output format is inferred from the file extension (.json, .csv, .html, default JSON).
      • New --client-mac MAC flag (exhaust only) pins or rotates through specific source MACs instead of using random ones.
      +1 more show less
      • Packaged as a .deb for Debian/Kali, placing both dhcpig and dhcpig-web on PATH without a virtualenv.
    7. 2.7.1 Aug 2, 2026 · release notes

      DHCPig 2.7.1 adds device OS tagging, new CLIENTS_HOLDING_STOLEN_LEASES finding, unicast ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. conflicts, and dashboard graphing enhancements.

      └──▷ GET THIS VERSION 
      $ git clone --branch 2.7.1 https://github.com/kamorin/DHCPig.git
# already have the repo? check out this version:
$ git checkout 2.7.1
      • Adds device field to _neighbor_rollcall() rows to include short OS/vendor tags in roll-call output
      • Introduces new finding CLIENTS_HOLDING_STOLEN_LEASES (FAIL/high) for hosts defending addresses we already hold
      • Adds unicast ARP-conflict frame support via build_arp_conflict_unicast() to target victims directly
      • Increases eviction density with new evict_rounds 6 and timeouts.evict_interval 1.5s configuration defaults
      • Adds pool_exhausted and leases_acquired fields to NeighborSummary for explicit pool exhaustion reporting
      +4 more show less
      • Changes dhcpig-web to open a browser by default; adds --no-open flag to opt out
      • Updates window_growth_per_ack default from 0.01 to 0.005, requiring 200 clean ACKs per +1 window slot
      • Expands dashboard graphing to plot four separate transmit-side lines (ARP, DISCOVER, RELEASE, RENEW) instead of merged rates
      • Adds seen_via tracking to distinguish hosts observed via ARP versus DHCP in roll-call output

      9 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !Default evict_rounds changed from 4 to 6
      • !Default timeouts.evict_interval changed from 3.0s to 1.5s
      • !Default window_growth_per_ack changed from 0.01 to 0.005
    8. docs update Aug 1, 2026 · issue 032

      DHCPig adds a web UI, five named attack/scan modes, and new flags including --dry-run, --scope, --report, and --no-spoof-eth-src

      └──▷ TRY IT
      Exhaust a DHCP pool scoped to a specific subnet and save a full HTML report for the engagement record.
      $ sudo .venv/bin/dhcpig exhaust eth0 --scope 192.168.4.0/22 --report run.html
      Run a read-only ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. + DHCP fingerprint sweep against a subnet without touching any leases — safe for recon during an assessment.
      $ sudo .venv/bin/dhcpig active-scan eth0 --scope 192.168.4.0/22
      Launch the web UI on a headless VM and access it locally via SSH port-forwarding to review results in a browser.
      $ # On the VM:
sudo .venv/bin/dhcpig-web
# On your workstation:
ssh -L 8787:127.0.0.1:8787 user@<vm-ip>
# Then open: http://127.0.0.1:8787/?token=...
      • New web UI (dhcpig-web --open) provides a browser-based interface for running and reviewing DHCP attack sessions at http://127.0.0.1:8787/?token=...
      • New exhaust mode: ARP-inventories the segment, floods DISCOVER/REQUEST from fabricated MACs, and verifies whether a new client can still obtain an address after pool exhaustion
      • New release mode: releases every active neighbour's lease via DHCPRELEASE (no proof of ownership required) and reports whether any host loses connectivity
      • New release-previous / restore modes: replays the on-disk lease journal to return addresses taken in a prior run, enabling post-engagement recovery
      • New active-scan mode: read-only ARP sweep plus DHCPINFORM to fingerprint DHCP servers without taking any addresses or disturbing leases
      +11 more show less
      • New scan mode: passive read-only listener that fingerprints hosts by DHCP option-55 order and MAC vendor without sending any traffic
      • New ifaces subcommand lists available network interfaces
      • New --dry-run flag performs ARP sweep and control transactions only — no mutating packets sent
      • New --scope CIDR flag bounds targets to a specific subnet (repeatable); defaults to the interface's own network
      • New --report FILE flag writes a session report in JSON, CSV, or HTML format based on file extension
      • New --no-spoof-eth-src flag uses the real NICNICA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link. MAC as the Ethernet source, enabling use on Wi-Fi where APs drop frames from unassociated MACs
      • New --client-mac MAC flag for exhaust mode allows specifying one or more MACs to rotate through instead of random fabrication
      • New --request-option SPEC flag for exhaust mode controls which DHCP options are requested (e.g. 12,14-19,23)
      • New --no-evict flag skips the ARP-conflict phase across applicable modes
      • New --rate N flag sets packet rate (pps, default 7) for modes that don't self-pace
      • Lease journal stored at $XDG_STATE_HOME/dhcpig/leases-<iface>.jsonl records MAC, IP, server, and timestamp per lease taken for engagement audit purposes

      16 details in Everything

    9. docs update Aug 1, 2026 · issue 032

      DHCPig gains a web UI, five attack/recon modes, structured reports, and a lease-recovery workflow for DHCP hardening validation.

      └──▷ TRY IT
      Exhaust a DHCP pool on a scoped subnet and capture the full session report as JSON for post-engagement review.
      $ sudo .venv/bin/dhcpig exhaust eth0 --scope 192.168.4.0/22 --report run.json
      Run a read-only active scan to fingerprint DHCP servers without touching any leases — safe for recon during an assessment.
      $ sudo .venv/bin/dhcpig active-scan eth0 --scope 192.168.4.0/22
      Launch the web UI on a headless VM and access it locally via SSH port-forwarding for a graphical view of attack results.
      $ # On the VM:
sudo .venv/bin/dhcpig-web
# On your workstation:
ssh -L 8787:127.0.0.1:8787 user@<vm-ip>
# Then open the printed http://127.0.0.1:8787/?token=... URL in your browser.
      • Adds dhcpig-web command that launches a browser-based web UI (binds loopback on port 8787 with token auth) for running and reviewing DHCP attack sessions without the CLI.
      • Adds exhaust mode: ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery.-inventories the segment, floods DISCOVER/REQUEST from fabricated MACs, releases neighbours' leases, and forges ARP conflicts to validate whether new clients can still obtain addresses.
      • Adds release mode: evicts currently active clients via DHCPRELEASE without exhausting the pool, then checks whether hosts can re-acquire.
      • Adds release-previous recovery mode: replays the on-disk lease journal to return every address taken in a prior run, verifying the pool is usable again.
      • Adds active-scan mode: performs a read-only ARP sweep of a scope and sends DHCPINFORM to fingerprint DHCP servers without touching any leases.
      +12 more show less
      • Adds scan (passive) mode: silently watches DHCP and ARP traffic, fingerprinting hosts by DHCP option-55 order or MAC vendor — sends nothing.
      • Adds ifaces subcommand to list available network interfaces.
      • Adds --report FILE flag to write session results to disk in JSON, CSV, or HTML format (inferred from file extension).
      • Adds --scope CIDR flag (repeatable) to bound attack and scan operations to a specific subnet rather than the full segment.
      • Adds --dry-run flag for recon-only execution: runs ARP sweep and control transactions but skips all mutating packets.
      • Adds --no-evict flag to skip the ARP-conflict phase during exhaustion or release runs.
      • Adds --rate N flag to set packet-per-second rate (default 7) for non-exhaust modes.
      • Adds --client-mac MAC flag for exhaust mode to specify one or more real MACs (repeatable; rotates through the list) instead of random ones.
      • Adds --request-option SPEC flag for exhaust mode to control which DHCP options are requested (e.g. 12,14-19,23).
      • Adds --no-spoof-eth-src flag for exhaust mode to use the real NICNICA network interface card or adapter, the hardware that connects a computer to a network. It sends and receives packets over the link. MAC as the Ethernet source, enabling operation on Wi-Fi where APs drop frames from unassociated MACs.
      • Adds per-run lease journal stored at $XDG_STATE_HOME/dhcpig/leases-<iface>.jsonl capturing MAC, IP, server, and timestamp for every lease taken — supports release-previous recovery and engagement record-keeping.
      • Adds restore subcommand to release leases back to the DHCP server while the same process is still running.

      17 details in Everything

    10. 2.7.0 Aug 1, 2026 · release notes

      DHCPig 2.7.0 adds vendor-class matching and OS fingerprinting via new Satori data source

      └──▷ GET THIS VERSION 
      $ git clone --branch 2.7.0 https://github.com/kamorin/DHCPig.git
# already have the repo? check out this version:
$ git checkout 2.7.0
      └──▷ USE IT
      Run the new merge script to regenerate the fingerprint data if you need to update the underlying Satori XML source.
      shell 
      python3 data/satori-merge.py --convert dhcp.xml
      • Adds vendor class (DHCP option 60) as a new matching rung with 187 exact signatures at confidence 70, bridging the gap between option-55 matches and MAC-vendor guesses.
      • Populates the os field in database output for matched hosts (e.g., Windows 10, iOS 12), enabled by the new Satori data source which separates OS from device info.
      • Replaces the bundled packetfence_dhcp_fingerprints.json with satori_dhcp_fingerprints.json to align licenses and update the fingerprint database.

      3 details in Everything

      └──▷ BREAKING ON UPGRADE
      • !The script data/fingerprint-merge.py is renamed to data/satori-merge.py, removing the old path.
    11. 2.5.0 Jul 29, 2026 · release notes

      DHCPig 2.5.0 adds --scope to exhaust, fixes hanging active-scan, and improves detection logic

      └──▷ GET THIS VERSION 
      $ git clone --branch 2.5.0 https://github.com/kamorin/DHCPig.git
# already have the repo? check out this version:
$ git checkout 2.5.0
      └──▷ USE IT
      Limit the DHCP exhaustion attack to a specific subnet scope for more controlled testing.
      shell 
      dhcpig exhaust --scope 192.168.1.0/24
      • Adds --scope argument to the exhaust subcommand to bound the ARPARPA network protocol that maps IP addresses to MAC addresses on a local Ethernet segment, letting tools resolve layer-3 targets to layer-2 hardware addresses for packet crafting or host discovery. sweep and make pool-size estimation deterministic

      1 detail in Everything

    Project health

    Issue, contributor and maintainer activity in kamorin/DHCPig, 2023-10 – 2026-09, as of 2026-09-25. Twelve-month figures first; the trend lines run the whole window.

    1. Contributors 2 +2 vs prior 12 months
    2. Maintainers 1 +1 joined · −0 left, last 12 months
    3. Bus factor 1 committers behind half the commits
    4. Community-filed not measured of issues opened, last 12 months
    5. Median time to close not measured issues closed, last 12 months
    6. Open backlog 0 of 11 issues ever filed
    1. Issues opened / month 0 · 0 communitymaintainers
    2. Open backlog 0
    3. Contributors / month 2
    4. Commits / month 10
    5. Stars 354
    Issue themes, last 12 months not measured

    Counts from the project's public repository and git history; no individuals are identified. Maintainers are the committers covering 80% of the last year's commits. how we measure this

    Libraries its release ships

    What its latest release locks, checked against known advisories.

    None of its release's images build from a lockfile we can read.

    Add the badge to your README

    Maintain this project? The badge links readers straight to this page, so they can follow every release here.

    Tracked by Cyber Toolchain Choose a badge style and copy the code →
    compare.md

      Free the public facts, no sign-in Any paid plan all other sections Researcher & Business pricing history and category rank

      my-toolchain — 0 tools

        Betas, release candidates and previews. Turn it off to see final releases only. It also applies to changes you ask for over MCP when you're signed in.
        browse all tools → score card for your toolchain →
        cyber-toolchain / feedback

        Send us feedback