1

I am working as an network engineer support in a company. Our network does not have any DHCP configured for it, we use static for any device... But like a month ago we suddenly have a dhcp server which not coming from our default gateway.

example default gateway is 172.16.40.254 and dhcp is coming from 172.16.40.204.

I checked the configuration of our core switch and router and there is no DHCP configured there. Please help.

  • 2
    Many switches can be set to disallow DHCP servers coming from ports where you don't expect a DHCP server (if you have none, all ports) which can limit the effect of a rogue DHCP server being plugged in. Where you do have a DHCP server on-line, you configure the switches to only allow DHCP from the port(s) that lead to your DHCP server. – Ecnerwal May 25 '17 at 19:51
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Feb 19 '18 at 4:17
4

One way to trace this is:

  1. capture DHCP traffic from the server
  2. check for the source MAC address
  3. look up this MAC address in the forwarding tables of your switches to identify the switch port to which this server is connected

Possibly you have ARP entries for 172.16.40.204 on other machines in your network. In that case you can skip the first two steps.

The MAC address may also help you identify the brand of machine providing these DHCP services, by using a vendor lookup tool like this one.

| improve this answer | |
4

Most likely you have a rogue DHCP server on your network. Probably a Home grade router that someone brought in to get more network ports in their office or area.

You'll need to hunt down the MAC address in the Hardware Address Tables of your switches so you can find the device and confiscate it.

First thing to do is to find out the MAC address of the gateway IP that's being handed out. Do that by first pinging the DHCP server's IP address from the router it's showing up on. Then query the ARP table on the router show arp. Either that, or get a laptop to get a DHCP lease from the device, ping the dhcp server's address, then run arp -an on the laptop to get the MAC address of the DHCP server.

Once you have your MAC address, you can search the MAC address tables on your switches to try and find it show mac-address-table. Start with the switches closest to the router. The arp table will show the port that MAC address is associated with. If there's another switch plugged into that port, get onto that switch and repeat the process until you find a port associated with the DHCP server's MAC address that isn't plugged into another piece of your network equipment.

Once you've identified the port, go trace some cables and find out where your rogue device is physically.

Then you have the sometimes fun task of writing paperwork to discipline the user that plugged un-authorized equipment into your network. Make sure you have a company policy that prohibits such things. Don't actually confiscate the device unless you're allowed to by that policy. You should be able to remove the device from the network however with no issues.

Keep in mind that it may also be one of those newer printers with WiFi. This may be solved by re-configuring the device to not act as a DHCP server.

If you don't have a policy in place, write one! Then get your C-level executives to sign off on it. The network is the company's property and you are it's caretaker. You need to make sure you have the authorization to protect it.

Lastly, investigate your network device vendor's documentation on DHCP snooping. This can help you lock down your network and keep rogue DHCP servers from doing any damage.

P.S.: Static IPs everywhere?!? You must not have a lot of hosts on the network. I would take a look at implementing DHCP leases instead of Static IPs. That way you have more control over the things plugged into your network and your address space.

| improve this answer | |

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.