I am supporting a mixed Mac OSX and Windows environment. There is a rogue DHCP Server which seems to be providing the IP-addresses to Mac systems on the network. I have used both ZenMap and Wireshark to locate this IP-address and suspected Mac.
The problem is that when I access this suspected Mac, I cannot find any trace of any DHCP server. Yet this particular rogue DHCP Server influences ability to use a particular network shared printer.
The additional weird thing is that "the Mac" (which ZenMap/Wireshark) which serves as the host of the rogue DHCP server ends up having a "self-assigned IP address" [wait is it not supposed to have the IP address of the DHCP Server]
In an attempt to manage that rogue DHCP Server, I proceeded to install ServerAdmin tools from Apple. This tools did not find any Server at the IP address (of the server) which I obtained via Zenmap/Wireshark - basically it seems that particular server does not exist as far as the tools are concerned.
Even if those tools confirm the existence of the server, I still have another problem that I do not have the login details for that server.
Does anyone have any ideas on how to solve this weird scenario being able to access this rogue DHCP server (using details found via ZenMap/Wireshark) and manage the server.
sudo lsof -i:bootps
on the Mac, and see if that shows a process listening for DHCP/bootp requests. If it sees a process, report back with its info and we can go from there. Oh, and one more question: what version of OS X is this Mac running?