ayi <p>What’s the best approach towards determining if I have a rogue DHCP server inside my network?</p> <p>I’m wondering how most admins approach these kinds of problems. I found <a href="http://www.net.princeton.edu/software/dhcp_probe/" rel="noopener nofollow ugc">DHCP Probe</a> through searching, and thought about trying it out. Has anyone had experience with it? (I would like to know before taking the time to compile it and install).</p> <p>Do you know any useful tools or best-practices towards finding rogue DHCP servers?</p>
ayi_2 <p>One simple method is to simply run a sniffer like tcpdump/wireshark on a computer and send out a DHCP request. If you see any offers other then from your real DHCP server then you know you have a problem.</p>
