Wrong DNS IPs (82.163.143.169, 82.163.142.171) being picked by user machines

[tiwariharish44]

Hi,

Since last few days our network users have been complaining about no network access. When their computers are checked, they are found to be having fetched wrong DNS IPs (82.163.143.169 &
82.163.142.171) from the DHCP server, while these address do not belong to our network anywhere. 

Why is this happening. Is this some kind of Security concern or something like that? Any feedback provided will be much appreciated . 

Thanks

[Leo Laohoo]

Someone may have spun up a rogue DHCP server.  

Security concern, you bet!

[tiwariharish44]

Hi Leo,

This problem is spread across the whole campus network. It is not just limited to a single distribution switch, but across users connected to different distribution switches.

[Leo Laohoo · Accepted solution]

This problem is spread across the whole campus network. It is not just limited to a single distribution switch, but across users connected to different distribution switches.

What's the point? 

If someone has spun up a rogue DHCP server and pumping stupid DHCP options, anything can happen.  

Enable DHCP Snooping in the core switch and observer for any improvements.

[tiwariharish44]

Another thing to note, the DNS is shown to be put statically in the TCP/IP settings of the user machines, while nobody has done so. Check the attached file.