User Tools
networking:dhcp_find_rogue
This is an old revision of the document!
Table of Contents
Find a Rogue DHCP Server
DHCP Process
DORA
- Discover
- Client
- Offer
- Server
- Request
- Client
- Acknowledge
- Server
Capture the Process
- Note the IP address of valid DHCP server
- Start Wireshark
ipconfig /releaseipconfig /renew- Save the capture
find_rogue.pcap
Analyze the Capture
In Wireshark:
- Open the
.pcapfile - Filter on
bootppackets
networking/dhcp_find_rogue.1532111272.txt.gz · Last modified: 2018/07/20 12:27 by gcooper
Except where otherwise noted, content on this wiki is licensed under the following license: CC Attribution-Share Alike 4.0 International
