1

I am supporting a mixed Mac OSX and Windows environment. There is a rogue DHCP Server which seems to be providing the IP-addresses to Mac systems on the network. I have used both ZenMap and Wireshark to locate this IP-address and suspected Mac.

The problem is that when I access this suspected Mac, I cannot find any trace of any DHCP server. Yet this particular rogue DHCP Server influences ability to use a particular network shared printer.

The additional weird thing is that "the Mac" (which ZenMap/Wireshark) which serves as the host of the rogue DHCP server ends up having a "self-assigned IP address" [wait is it not supposed to have the IP address of the DHCP Server]

In an attempt to manage that rogue DHCP Server, I proceeded to install ServerAdmin tools from Apple. This tools did not find any Server at the IP address (of the server) which I obtained via Zenmap/Wireshark - basically it seems that particular server does not exist as far as the tools are concerned.

Even if those tools confirm the existence of the server, I still have another problem that I do not have the login details for that server.

Does anyone have any ideas on how to solve this weird scenario being able to access this rogue DHCP server (using details found via ZenMap/Wireshark) and manage the server.

  • It's not clear how you're looking for the DHCP service on the suspect Mac. Note that Apple's server app is only one of a number of things that might set up & run the DHCP/bootp server on a Mac, so checking that won't tell you if e.g. the Internet Sharing has started DHCP service. What I'd do is run sudo lsof -i:bootps on the Mac, and see if that shows a process listening for DHCP/bootp requests. If it sees a process, report back with its info and we can go from there. Oh, and one more question: what version of OS X is this Mac running? – Gordon Davisson Jul 9 '14 at 18:19
  • Version is 10.6.4 – Sysuser Jul 9 '14 at 18:25
  • good to hear that Server does not see all DHCP/bootp. at least it gives hope of getting resolution that beyond wipe/rebuild – Sysuser Jul 9 '14 at 18:39
  • COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME bootpd 55 root 0u IPv4 0x07cca2e8 0t0 UDP *:bootps – Sysuser Jul 9 '14 at 18:39
  • @GordonDavisson kindly see above the result of the command ... seems it was a "bootp" process ... – Sysuser Jul 9 '14 at 18:40
2

If you have the MAC address of the system which is serving DHCP, you should attempt to find where it's physically plugged into your network by logging into your network switches and checking their MAC address tables (on Cisco devices, show mac address-table).

That will show you which interface on that switch the MAC address is apparently connected from - if you have multiple switches, you'll need to follow that trace though to the switch that the device is actually connected to.

  • Thanks would have a good at your suggestion and see what comes up ... – Sysuser Jul 9 '14 at 17:03
  • I have done as suggested (ala Cisco CLI) and the following were ascertained: 1. The Mac identified as the host for the rogue DHCP server, still remains the host. 2. The mac address of the port (via which the DHCP broadcasts) is also the same as that of the Mac host. Consequently, what is needed now is how to access that rogue DHCP Server on this machine seeing that Apple's own tools cannot even see this DHCP Server. – Sysuser Jul 9 '14 at 17:47
  • @Sysuser So you've identified the physical device that's serving DHCP, or? – Shane Madden Jul 9 '14 at 17:54
  • Yes I have identified the physical device serving DHCP – Sysuser Jul 9 '14 at 17:58
  • @Sysuser So are you still missing login information - and is this a server that's actually serving services your business needs? If you need to keep the system around but don't have credentials, you should reset the password. – Shane Madden Jul 9 '14 at 18:01
2

on the mac that is hosting the rogue DHCP service. sudo launchctl unload -w /System/Library/LaunchDaemons/bootps.plist

This will turn off bootpd, which is the DHCP server. You might also check the internet sharing settings in system preferences (which is the other common user of DHCP on the system besides Mac OS X Server)

To see if Mac OS X Server is running check for a listener on port 311, or ps ax | grep servermgrd

HTH - Leland

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.