networking - Rogue DHCP can't be found -
over last 3 weeks have been trying find rogue dhcp server on network have been stumped! offering ip addresses not work network device needs dynamic address getting 1 rogue dhcp. need find , destroy thing!
my main router valid dhcp server , 192.168.0.1 offers range of 192.160.0.150-199. rogue dhcp claims coming 192.168.0.20 , offering ip address in range of 10.255.255.* messing on network unless assign static ip address it.
my network single ad server on windows 2008r2, 3 other physical servers (1-2008r2 , 2 2012r2) 4 hypervisor machines, 3 laptops , windows 7 box.
i can't ping rouge 192.160.0.20 ip , can't see in arp -a output can't it's mac address. i'm hoping reading post has come across before.
run sniffer on system sending out dhcp requests. @ source mac address in responding packets rogue dhcp server. next, go switches , pull mac addresses mapped ports in cam table figure out port it's connected to.
if follow wire end you'll find server.
Comments
Post a Comment