How to detect rogue DHCP servers on your network

Glad to have you back! Hope you enjoy the following article...

This article may be a bit more technical for most people, but anyone who ended up here probably knows all about DHCP servers. Commonly, a DHCP server gives out IP addresses to your network and there is often only one server to do this job.

DHCP – There can be only ONE!

Well not really, there can be others but that out of the “scope” of this article. Once in awhile a problem comes into the network, either through a hacker or uneducated user, that they add a device (router, personal server, Linksys wireless router, etc) to the network. What happens then is a conflict between your original DHCP server and the newly added device.

When this happens certain things may occur…

Your workstations will get a IP from either your authorized DHCP or the rogue device.
Workstations will not be able to connect to the Internet
Workstations or Server may have duplicate IP addresses which means, no connectivity!
Your authorized DHCP may get intermittent problems, such as not receiving pings.

Anyway, all of the above was such my case one fine Monday morning. It isn’t fun because it wasn’t until I replaced network cables, switched NICs, and did a few other tests that I realized a rogue device was on my network. So let me help you skip past all this mess and download a Microsoft tool to detect Rogue DHCP servers.

Rogue DHCP Server Detection

In short, there are a few other resources you can lean on for more in depth detection but I’ll suggest a tool for now. DHCP Server Prevention is an entirely more difficult task and more complex, so I wont cover that in this article. For the time being, and for diagnosis I suggest Microsoft’s Rogue DHCP Server Detection Tool. You can download it below.

http://blogs.technet.com/teamdhcp/attachment/3260962.ashx

I’d like anyone else’s advice or experience with these problems! I know we’re all in the same boat once in awhile when it comes to DHCP issues and connectivity!

If you enjoyed this post, make sure you subscribe to my RSS feed!

Related posts: