Unknown Hardware MAC Address DHCP Request

Darshan Thummar@Mighty

•updated Jun 11, 2026•1•0•5

This rule detects DHCP requests originating from a MAC address that is not recognized or expected within the network. It uses a threshold to prevent excessive alerts from a single source, triggering if a source makes more than one DHCP request within a 5-second window. This could indicate an unauthorized device attempting to join the network or a spoofed MAC address.