How do I find a rogue DHCP server on a Cisco switch?

Posted on 2008-11-03
Last Modified: 2010-05-18
I am having an issue with someone attaching a rogue DHCP server to my network.  I need to find out who is doing this, and so far I have come up with nothing.  I am assuming that I can somehow look at the switch activity when the rogue DHCP server is active to determine which port the traffic is coming from and shut it down, but I not sure what command to use or what to look at to see where the DHCP acks are coming from.
Question by:warewols
    1 Comment
    LVL 50

    Accepted Solution

    You could stop from happening in the first place.

    Once it occurs, you would need to determine the MAC of the DHCP server from the workstation.
    "arp -a"

    The view the mac address table on the switch.
    "show mac-address-table"

    That will show you which port the rogue DHCP server is connected to.


    Featured Post

    6 Surprising Benefits of Threat Intelligence

    All sorts of threat intelligence is available on the web. Intelligence you can learn from, and use to anticipate and prepare for future attacks.

    Join & Write a Comment

    Suggested Solutions

    This tutorial will go through the steps required to write a script that will back up the configuration settings of a HP-ProCurve switch. You will need to get the following things to follow this tutorial: Telnet Scripting Tool e.g. TST10.exe …
    I eventually solved a perplexing problem setting up telnet for a new switch.  I installed a new Cisco WS-03560X-24P switch connected to an existing Cisco 4506 running a WS-X4013-10GE Sup II-Plus. After configuring vlans and trunking,  I could no…
    how to add IIS SMTP to handle application/Scanner relays into office 365.
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…

    733 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    23 Experts available now in Live!

    Get 1:1 Help Now