Find other illegal DHCP servers in the Intranet

Very useful Dongdong, platinum brother's work. Today I need to post a blog to facilitate searching. haha .... because the DHCP protocol is Layer 2, the source and destination IP addresses of the illegal DHCP server in the network cannot be found. If there are multiple DHCP servers in the network at the same time, however, if your switch does not prevent the release of the DHCP protocol, this network is very dangerous (this is also the case in my community. If I set up something useful, platinum's work. Today I need to post a blog to facilitate searching. haha ....

 

 

Because the DHCP protocol is Layer 2, the source and destination IP addresses of the illegal DHCP server in the network cannot be found.

If there are multiple DHCP servers in the network at the same time, and your switch does not prevent the release of the DHCP protocol, this network is very dangerous (this is also the case in my community, if DHCP is set up, I will see/var/lib/dhcp/dhcpd. leases sees many assigned IP addresses)

We can use tcpdump to capture packets to determine the MAC of the other Party. If MAC is available, it will be easy.

Under normal circumstances, tcpdump captures three layers of packages. Only the IP header and other four-layer headers (such as TCP/UDP) can be seen)

Tcpdump has a-e parameter.

-E Print the link-level header on each dump line.

This is the key, and another key part is port, because the dhcp protocol will use UDP/67. It's easy to understand these two points. Capture packets and check the MAC.

If you have a MAC address, you can use arp-n to view its IP address. Next, block the MAC address on the gateway and let him "surrender". ^_^

[Root @ platinum root] # tcpdump-e-I eth1-nn port 67-c 3 2> & 1 | awk '/bootp/{print $2 "-->" $3 }'
0: 0c: 85: ad: e5: af --> ff: ff
E7: 0a: 19: 80: 03: 09 --> 0: 0c: 85: ad: e5: af
0: 0c: 85: ad: e5: af --> e7: 0a: 19: 80: 03: 09
[Root @ platinum root] #