Kea
Kea
Posted Jun 3, 2025 4:13 UTC (Tue) by raven667 (subscriber, #5198)In reply to: Kea by Sesse
Parent article: Local vulnerabilities in Kea DHCP
Yeah, dhcpd was battle tested and worked fine, although more complex configurations were ... complex, and I'm not sure it's bespoke config syntax is better than just using JSON like Kea. Unfortunately for me I _do_ have one of those sites with 100k+ clients, and while HA dhcpd worked OK in normal circumstances, if there is any network instability and clients have to retry it can become overwhelmed at that scale, peg 100% CPU on the single core it runs on, and your network doesn't work which makes for a lot of unhappy people. Kea seems to have about 10x higher limits on performance, the fact its not higher is probably related to locking since it's still managing one shared datastructure but I don't have enough CS background or time to figure it out exactly, but I'm sure the smarties at ISC did something reasonable.
I imagine the Enterprise distros that shipped dhcpd in their last release will continue to maintain it for the next 5+ years, and it's not as if there should be a ton of maintenance in such a mature codebase.
