I have a network with a DHCP server and RADIUS authentication.

Clients connect to my network, get a DHCP address, enter the signing in page, input their prepaid cards, and get to the Internet.

We sometimes see some clients (was once malicious) connect a router to one of my Access Points and they don't disable DHCP functionality on that router... The entire network falls apart, until we disconnect that actor or re-configure his router correctly to disable DHCP, and allow that router to take a DHCP lease from the main DHCP server we control.

So How do I force my network to only honor the DHCP server I control?

In fact, the whole problem I see now is a packet loop. I'm assuming it's someone who's connected a wrongly configured router with DHCP enabled. So I'm trying to disallow anyone from assuming DHCP role.

DHCP Server is at (RouterBoard device)

Network Diagram


You can't prevent someone from activating DHCP, but you can set up your RouterBoard with 'Rogue DHCP Detection', and either alert you when that occurs, or (with additional scripting / automation) programmatically block their switch port or Wifi access.

On your DHCP server, the alert would look like:

00:34:23 dhcp,critical,error,warning,info,debug dhcp alert on Public:
    discovered unknown dhcp server, mac 00:02:29:60:36:E7, ip

See http://wiki.mikrotik.com/wiki/Manual:IP/DHCP_Server for more details.

| improve this answer | |
  • Thanks, I added an Alert. Nothing seem to come up. Also, How do I block them? Note that most likely they'll be connected to one of my NanoStation M2 devices at the edge of the network. – Questioner Dec 10 '16 at 0:07
  • There's nothing canned that will do that. You'd have to have some sort of script that takes that information and configures your nanostations to block that MAC. That'll knock the node off your network entirely. – Jason Martin Dec 10 '16 at 2:57

Did you try DHCP snooping

DHCP snooping is a layer 2 security technology built into the operating system of a capable network switch that drops DHCP traffic determined to be unacceptable. The fundamental use case for DHCP snooping is to prevent unauthorized (rogue) DHCP servers offering IP addresses to DHCP clients. Source

although looks like your gear may not support it, so the reactive approach might be your only option.

| improve this answer | |
  • As already mentioned: Cisco switches allow for so-called "DHCP snooping": It is possible to specify trusted and untrusted ports. The trusted port should be the port where the DHCP server is connected to. The switch does not allow any DHCP responses (offer, ack) on untrusted ports. – Tom Dec 2 '19 at 11:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.