How do I find a rogue DHCP server on a Cisco switch?

I am having an issue with someone attaching a rogue DHCP server to my network.  I need to find out who is doing this, and so far I have come up with nothing.  I am assuming that I can somehow look at the switch activity when the rogue DHCP server is active to determine which port the traffic is coming from and shut it down, but I not sure what command to use or what to look at to see where the DHCP acks are coming from.
warewolsAsked:
Who is Participating?
 
Don JohnstonConnect With a Mentor InstructorCommented:
You could stop from happening in the first place.
http://www.cisco.com/en/US/docs/switches/lan/catalyst4500/12.1/13ew/configuration/guide/dhcp.html

Once it occurs, you would need to determine the MAC of the DHCP server from the workstation.
"arp -a"

The view the mac address table on the switch.
"show mac-address-table"

That will show you which port the rogue DHCP server is connected to.

0
Question has a verified solution.

Are you are experiencing a similar issue? Get a personalized answer when you ask a related question.

Have a better answer? Share it in a comment.

All Courses

From novice to tech pro — start learning today.