Some thoughts... How would be possible to "dry" up a dhcp pool? Im just speculating here, if you have anything to add, please do.

To deny NEW clients access: To remove the availability of any *more* dhcp clients gaining access to a network, one would have to make a DHCP server assign every non-leased address in its pool. This can theoretically be done by spoofing DHCPDiscover/Request packets and fooling the DHCP server into assigning an IP to a spoofed MAC sent along with the DHCPDiscover/Request packets. The switch would also have to be "told" that off of your port, exists the spoofed MAC addresses, in essense, poisoning the ARP cache as skalez was asking about. So... by poisoning the ARP cache, and sending false DHCPDiscover/Request packets, could one get a DHCP server to assign away every address in it's pool?

If the client machine propagating this attack gathered all the DHCPOffer and DHCPAck packets, it could maintain its own listing of false MAC-to-IP mappings along with lease times so that at 50% of the lease time, the lease could be extended by another DHCPRequest packet... this would prolong the DoS against the DHCP server.

Now the issue of "stealing" MAC-to-IP mappings that are already assigned/lease out... here im kinda lost, and where I would like some input. I think one would go about it the same way as above, but im not quite sure... hmmm.

Yes, this is just me blabering about bullshit. Help if you can