What's the best approach towards determining if I have a rogue DHCP server inside my network?
I'm wondering how most admins approach these kinds of problems. I found DHCP Probe through searching, and thought about trying it out. Has anyone had experience with it? (I would like to know before taking the time to compile it and install).
Do you know any useful tools or best-practices towards finding rogue DHCP servers?
Answer
One simple method is to simply run a sniffer like tcpdump/wireshark on a computer and send out a DHCP request. If you see any offers other then from your real DHCP server then you know you have a problem.
No comments:
Post a Comment