How do I find a rogue DHCP server on a Cisco switch?

Posted on 2008-11-03
Medium Priority
Last Modified: 2010-05-18
I am having an issue with someone attaching a rogue DHCP server to my network.  I need to find out who is doing this, and so far I have come up with nothing.  I am assuming that I can somehow look at the switch activity when the rogue DHCP server is active to determine which port the traffic is coming from and shut it down, but I not sure what command to use or what to look at to see where the DHCP acks are coming from.
Question by:warewols
1 Comment
LVL 50

Accepted Solution

Don Johnston earned 500 total points
ID: 22872744
You could stop from happening in the first place.

Once it occurs, you would need to determine the MAC of the DHCP server from the workstation.
"arp -a"

The view the mac address table on the switch.
"show mac-address-table"

That will show you which port the rogue DHCP server is connected to.


Featured Post

Free Tool: Site Down Detector

Helpful to verify reports of your own downtime, or to double check a downed website you are trying to access.

One of a set of tools we are providing to everyone as a way of saying thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This tutorial will go through the steps required to write a script that will back up the configuration settings of a HP-ProCurve switch. You will need to get the following things to follow this tutorial: Telnet Scripting Tool e.g. TST10.exe …
I eventually solved a perplexing problem setting up telnet for a new switch.  I installed a new Cisco WS-03560X-24P switch connected to an existing Cisco 4506 running a WS-X4013-10GE Sup II-Plus. After configuring vlans and trunking,  I could no…
We’ve all felt that sense of false security before—locking down external access to a database or component and feeling like we’ve done all we need to do to secure company data. But that feeling is fleeting. Attacks these days can happen in many w…
Whether it be Exchange Server Crash Issues, Dirty Shutdown Errors or Failed to mount error, Stellar Phoenix Mailbox Exchange Recovery has always got your back. With the help of its easy to understand user interface and 3 simple steps recovery proced…
Suggested Courses

830 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question