Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Possible Duplicate:
How do I find if there is a rogue DHCP server on my Network?

I know this is a serious long shot, but here we go.

In the past week or so, for users connected to a particular switch in our network (there are four dumb switches all connected, and it only affects SOME, not all, users on the one switch) are getting DHCP addresses from a rogue DHCP server.

I have physically checked every cable plugged into the switch in question to make sure that none of them have a router or wifi point attached to it. I know the IP of the DHCP server, but I cannot ping it, and it does not have a web interface.

Does anyone have any suggestions on what I can do to locate it or shut it down? Unfortuantely all the switches are unmanaged, and as mentioned, there's no physical device (that I can find) plugged in to anything.

It's getting critical, because it's screwing up the PXE boot of a whole bunch of thin clients.

share|improve this question

marked as duplicate by Chris S Sep 25 '12 at 15:04

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

1  
As a side note, DHCP Explorer purports to be able to find rogue DHCP servers: networksecurityhome.com/network_tools/dhcp_discovery/… –  joeqwerty Jan 12 '10 at 4:38
1  
Interesting. I wish I had known about all these tools days ago! I should have come here first! –  Mark Henderson Jan 12 '10 at 6:30
2  
Love the tag. :) –  Peter Eisentraut Jan 12 '10 at 10:17
    
There are very affordable switches around that have a built in rogue DHCP server filter configurable per port. The less than 250 Euro that eg a GS-1224 (The Lancom one, not D-Link) will cost you are probably less than the cost you in the end summed up chasing that rogue down... –  rackandboneman May 9 '12 at 21:31
    
On a different note: There are also some models of LAN print servers that can function as a rogue DHCP, in case somebody finds that question with the same problem in the future... –  rackandboneman May 9 '12 at 21:33

5 Answers 5

up vote 18 down vote accepted

Try to nmap it using the -O to detect the operating system, may give you a better idea of what server it is? Also running a standard port scan might help figure out what it is

share|improve this answer
    
The only port open is 67 (or responding at least) :( I hadn't thought of nmap -O though! I'll give it a go –  Mark Henderson Jan 12 '10 at 1:32
5  
Ahah! It was a Virtual Machine someone was running on their development machine. nmap had the info I needed in seconds. Brilliant! –  Mark Henderson Jan 12 '10 at 1:46
    
Wow, how fricking annoying is that. Completely unfindable. –  Satanicpuppy Jan 12 '10 at 1:57
5  
looking at the MAC address to figure out the vendor would also have been a good way of knowing it was a virtual machine. Glad you got to the bottom of it :D –  Nick Kavadias Jan 12 '10 at 4:17

I know this has already been solved but another means, when you really can't find the machine (knowing it's a VM doesn't tell you what host it's on) is to keep sending it DHCP requests and unplug each cable in turn till it shuts up. Sometimes you just have to get back to crude basics.

share|improve this answer

Run Wireshark to get the MAC address of the server. It should at least tell you the manufacturer (MAC addresses are centrally allocated and each manufacturer is allocated a set of addresses).

share|improve this answer

The fact that you can't ping it isn't a problem.

(This procedure is mostly for managed switches, in the case of your dumb switches, it isn't as helpful, since you can't inspect the cam table... but anyway.)

  1. run ipconfig /all(or look at syslog), note the IP address listed for "DHCP Server". Generally this is the same as the default gateway.
  2. attempt to ping this ip address, ignore the result.
  3. run arp -a. The mac address listed for the IP is your rogue DHCP server.

So, in your case, you can't follow this up with locating the switchport and disabling it, but you could have at least looked up the mac address vendor and would have found that the vendor was something like vmware or virtualbox.

If you have a box lying around, you can install https://roguedetect.bountysource.com/ on it, which will notify you if a problem like this occurs in the future.

share|improve this answer
    
Interesting tool. We've got a VMWare ESXi blade centre so I can deploy it on there with little system cost, which would certainly catch this in future. Thanks. (p.s. that site's certificate is expired) –  Mark Henderson Jan 12 '10 at 2:12

Well, you can always try to ping the crap out of it and check the blinky lights on the routers. =P

Does traceroute show you anything?

share|improve this answer
    
Hey there's another idea I hadn't thought of. This is why I love ServerFault. Nothing in traceroute as it's all all on the one switched network. –  Mark Henderson Jan 12 '10 at 2:05

Not the answer you're looking for? Browse other questions tagged or ask your own question.