Subscriber Services: Automatic validation of DHCPv6 client MAC addresses to reduce session hijacking

The DHCPv6 local server and relay agent automatically attempt to validate a client's MAC address to prevent accepting packets from malicious clients that attempt to hijack the client session. When DHCPv6 local servers and relay agents receive a solicit message from a client to establish a session, they extract the client MAC address (link-layer address) from the message and add it to a local table that maps MAC addresses to client IPv6 addresses or prefixes. They use this table to compare MAC addresses received in subsequent messages from the client to validate whether the client is known; if not, it is assumed to be malicious and the control packet is dropped. Because the packet has failed MAC validation, the client MAC validation counter is incremented.