I'm doing some research into ip roaming and haven't come across a whole lot. My definition of IP roaming is the client / server changing of IP addresses on a regular basis using a pre-set number of IP addresses that both client and server have knowledge of.

Specifically I'm interested in if anyone knows of any Linux applications that allow for IP address changing on regular intervals. I'm sure I can write something as a proof of concept, but I'm wondering if there's anything that already exists.

Err, yeah. A DHCP server with a pool......

I like that idea but in an IP Roaming situation you may only want the IP to change in the event that some event happens. Such as an attack or port scan. While the regular interval can be accomplished using a dhcp server, I'm unclear as to how to trigger the change in the event of an attack.

I've found a couple of papers on this so far but no specifics on software.

"A Simulation Study of the Proactive Server Roaming for Mitigating Denial of Service Attacks∗"
"Roaming Honeypots for Mitigating Service-level Denial-of-Service Attacks∗"

The next step think is a script like a post process that can run in the event that some sort of attack is detected. Perhaps a modification of Suricata or Snort could do this.

Perhaps script a DHCP server to respond to events with SNORT or similar?