cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
527
Views
0
Helpful
1
Replies

Rogue DHCP Servers

laneclark
Level 1
Level 1

Anybody know of a way to help track down "rogue" dhcp servers?

1 Reply 1

thisisshanky
Level 11
Level 11

All you need is a client that gets dhcp from this server, do ipconfig /all to find out the dhcp server ip address, ping the server to see if you get response from it. This will also create a arp entry in your client. Use arp -a to list the mac-address of the dhcp server. Do a scan of cam table in the switch to see if you can track the server by port. This wont work so well, if you have wireless network and the dhcp server is nothing but a laptop with a wireless card connected to your network. In this case, you can look at associated clients on your APs by mac address to track this down.

Or run a port scan on your network, which might give an idea of what services are running on your client PCs.

Sankar Nair
UC Solutions Architect
Pacific Northwest | CDW
CCIE Collaboration #17135 Emeritus

Review Cisco Networking for a $25 gift card