0

There appears to be a rogue DHCP server on our office LAN, occasionally preempting the DHCP server on our router, and assigning addresses that are owned by fixed servers.

I see all sorts of rogue DHCP detectors for WinDoze, but what about for Macintosh? (A Google search for "rogue DHCP detection macintosh" gets mostly false-positives, picking up "MAC Address").

2
  • 2
    Your question doesn go into details, but I assume you can't easily walk up to each Mac and check in System Preferences? Can you remotely access each Mac to check whether the ports used by DHCP are open?
    – nohillside
    Jan 21, 2022 at 17:03
  • The router is the best place to configure / check for this IMO. It manages who can say what in a switched environment and using clients to sniff this can be hit or miss….
    – bmike
    Jan 23, 2022 at 17:02

2 Answers 2

2

The best way to find this on your network is to sniff the traffic via a program like Wireshark.

Filter your Wireshark traffic for BOOTP traffic. Find the DHCP offer requests and find the one that doesn't match your official DHCP server.

From there you're going to have to find out how it's connected to your network which depends on your network topology.

1

I found my rogue DHCP server: it's the cable modem (whose DHCP function is supposedly turned off!).

The cable modem is an Arris DG1670A; the router/firewall is a TP-Link WDR-4300.

Following the comment from "hohillside," I went into System Preferences this morning, when my iMac came up "bottled," and found that its DHCP address had been vended by the cable modem's address (192.168.0.1), rather than by the TP-Link's address (192.168.1.1).

Then, seeing that the cable modem's DHCP address range is 192.168.0.2 to 192.168.0.254, I brought up my Chromebook, which almost always comes up "bottled" here, and sure enough, it came up "bottled," and the address it had been given wasn't a collision with a fixed address (e.g., 192.168.1.103) at all, but an address that's evidently not allowed in the office LAN: 192.168.0.103.

So now, the problem is figuring out why, with DHCP unchecked on the cable modem setup page, it's still serving DHCP, and/or what to do about it.

3
  • I wonder if there is a networking DIY or router site here for router questions. Perhaps super user? Your router configuration should be able to isolate the network the cable mode uses from the network your router uses - this is really more a networking topic.
    – bmike
    Jan 23, 2022 at 16:34
  • I just posted it to ServerFault. Jan 23, 2022 at 16:40
  • Share a link to this post in chat room for a site if you’re not sure it’s on topic there.
    – bmike
    Jan 23, 2022 at 17:01

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .