> > The attacker is inside the VM. > > > inside the VM where your DHCP live? no, inside a VM which used dhcp. > Then he already has control over all your DHCP network. Besides, we need to handle security for VM which does not use DHCP at all, so this does not really help.