ML
    • Register
    • Login
    • Search
    • Recent
    • Categories
    • Tags
    • Popular
    • Users
    • Groups

    Tool for Finding Rogue DHCP

    IT Discussion
    dhcp networking
    10
    19
    1932
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • scottalanmiller
      scottalanmiller last edited by

      Anyone have or know of a good tool for this? Software, obviously. Just something that triggers and traps DHCP requests. I know WireShark will do this, but something more concise would be nice and convenient.

      Obsolesce 1 Reply Last reply Reply Quote 0
      • black3dynamite
        black3dynamite last edited by

        Microsoft Rogue Check Tool
        https://www.tachytelic.net/2019/05/detect-rogue-dhcp-server/

        scottalanmiller 1 Reply Last reply Reply Quote 1
        • Obsolesce
          Obsolesce @scottalanmiller last edited by

          @scottalanmiller said in Tool for Finding Rogue DHCP:

          Anyone have or know of a good tool for this? Software, obviously. Just something that triggers and traps DHCP requests. I know WireShark will do this, but something more concise would be nice and convenient.

          More concise how? You can filter and get the ip of the rogue server.

          Dashrender 1 Reply Last reply Reply Quote 0
          • Dashrender
            Dashrender @Obsolesce last edited by

            @Obsolesce said in Tool for Finding Rogue DHCP:

            @scottalanmiller said in Tool for Finding Rogue DHCP:

            Anyone have or know of a good tool for this? Software, obviously. Just something that triggers and traps DHCP requests. I know WireShark will do this, but something more concise would be nice and convenient.

            More concise how? You can filter and get the ip of the rogue server.

            I'm guessing he really meant lighter weight app for the job.

            1 Reply Last reply Reply Quote 0
            • scottalanmiller
              scottalanmiller @black3dynamite last edited by

              @black3dynamite said in Tool for Finding Rogue DHCP:

              Microsoft Rogue Check Tool
              https://www.tachytelic.net/2019/05/detect-rogue-dhcp-server/

              Ugh, I hate .NET. Components required that we don't have in the environment. 😞

              1 Reply Last reply Reply Quote 0
              • Pete.S
                Pete.S last edited by

                Capture with tcpdump, analyze with wireshark on whatever machine you want.

                Pete.S jmoore 2 Replies Last reply Reply Quote 0
                • DustinB3403
                  DustinB3403 last edited by

                  Would nmap work for this?

                  sudo nmap --script broadcast-dhcp-discover -e eth0

                  Dashrender 1 Reply Last reply Reply Quote 0
                  • Pete.S
                    Pete.S @Pete.S last edited by Pete.S

                    @Pete-S said in Tool for Finding Rogue DHCP:

                    Capture with tcpdump, analyze with wireshark on whatever machine you want.

                    BTW, you can filter with tcpdump directly if you want and not use wireshark at all.

                    I think this will do the job:

                    tcpdump -n -i any port 67 or port 68 or port 69
                    
                    1 Reply Last reply Reply Quote 0
                    • Dashrender
                      Dashrender @DustinB3403 last edited by

                      @DustinB3403 said in Tool for Finding Rogue DHCP:

                      Would nmap work for this?

                      sudo nmap --script broadcast-dhcp-discover -e eth0

                      That thread - seems like tcpdump would be better, because it will capture all DHCP replies.

                      1 Reply Last reply Reply Quote 0
                      • black3dynamite
                        black3dynamite last edited by

                        https://www.question-defense.com/2012/10/02/sniff-all-broadcast-traffic-using-tcpdump
                        sudo tcpdump -i eth0 ether broadcast and ether multicast

                        1 Reply Last reply Reply Quote 0
                        • stacksofplates
                          stacksofplates last edited by

                          I took a library someone wrote and made a small program to print out DHCP message info. Let me know what platform you want it for and I'll build it for that.

                          1 Reply Last reply Reply Quote 0
                          • S
                            StorageNinja Vendor last edited by

                            @Pete-S said in Tool for Finding Rogue DHCP:

                            Capture with tcpdump, analyze with wireshark on whatever machine you want.

                            Turn on DHCP snooping on your switches and have it suppress DHCP servers on access ports.

                            1 Reply Last reply Reply Quote 1
                            • Pete.S
                              Pete.S last edited by Pete.S

                              This is what it looks like with tcpdump when you have two dhcp servers:

                              Captured on the DHCP client when the interface goes up.
                              dhcp_capture.png

                              DHCP server 1 is x.x.x.251
                              DHCP server 2 is x.x.x.252
                              Client IP becomes x.x.x.150

                              If you add the option -v for verbose you can see all the info inside the DHCP offer/ack.
                              For instance mac-address, lease-time, domain, ntp server etc.

                              When you have only one DHCP server and everything is working you will just see the IP from the one DHCP server. If you look closer at the communication you'll see that the first line will be the offer from the DHCP server and the second will be the acknowledge.

                              1 Reply Last reply Reply Quote 1
                              • jmoore
                                jmoore @Pete.S last edited by

                                @Pete-S tcpdump is what I was thinking of too.

                                Pete.S 1 Reply Last reply Reply Quote 0
                                • Pete.S
                                  Pete.S @jmoore last edited by Pete.S

                                  @jmoore said in Tool for Finding Rogue DHCP:

                                  @Pete-S tcpdump is what I was thinking of too.

                                  I think it's a good tool. Prior to this I've only used it to capture and then run wireshark to analyze but this thread showed up at the right time.

                                  The dual DHCP servers in my post above was a real scenario. Two DHCP servers in a failover configuration that I suspected didn't work as it should. And it didn't because both DHCP servers would send out an IP address but since they where synced the addresses didn't collide. I could verify and correct it with the help of tcpdump.

                                  1 Reply Last reply Reply Quote 0
                                  • wrx7m
                                    wrx7m last edited by

                                    Ran into this about 12 years ago. A guy on the dev team decided to setup his own DHCP server. Screwed up all sorts of stuff. Can't remember for sure what we did, but I think after we realized that it wasn't actually an issue with our known DHCP servers, we decided to talk to the dev team and found out that is what he had done.

                                    DustinB3403 Dashrender 2 Replies Last reply Reply Quote 0
                                    • DustinB3403
                                      DustinB3403 @wrx7m last edited by

                                      @wrx7m What happened with the dev?

                                      wrx7m 1 Reply Last reply Reply Quote 0
                                      • wrx7m
                                        wrx7m @DustinB3403 last edited by

                                        @DustinB3403 said in Tool for Finding Rogue DHCP:

                                        @wrx7m What happened with the dev?

                                        He was reprimanded but not fired.

                                        1 Reply Last reply Reply Quote 0
                                        • Dashrender
                                          Dashrender @wrx7m last edited by

                                          @wrx7m said in Tool for Finding Rogue DHCP:

                                          Ran into this about 12 years ago. A guy on the dev team decided to setup his own DHCP server. Screwed up all sorts of stuff. Can't remember for sure what we did, but I think after we realized that it wasn't actually an issue with our known DHCP servers, we decided to talk to the dev team and found out that is what he had done.

                                          It amazes me how many people just don't think about it - they have a problem, they think they know how to solve it, and just slap something onto the network.

                                          1 Reply Last reply Reply Quote 0
                                          • First post
                                            Last post