Weep
I think I'll just wait until it happens again and then shoot the B********'s who install it.
Can we notch this down as something SA CAN'T do? ;-)
Which, check for rogue DHCP servers or shooting BOFH?
Best wishes
Tobie
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Michael D. Shook
Sent: 21 January 2005 14:21
To: [email protected]
Subject: RE: [SA-list] DHCP Errors
BEWARE:
IF you think about doing this as an external check, the protocol has a built in timeout. So, for any given DHCP request series, you may or may not see all or any of your DHCP servers. On large subnetted or busy LANs it is not unusual to see several requests sent before a DHCP server can respond. The NIC will take the first one it gets and ignores the others. I don't think the NIC will even report seeing the others as those packets are dropped.
Michael D. Shook
Technical Analyst
[EMAIL PROTECTED]
863 668 4477 (work)
863 860 4070 (cell)
863 665 1261 (fax)
www.saddlecrk.com
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Dirk Bulinckx
Sent: Friday, January 21, 2005 9:06 AM
To: [email protected]
Subject: RE: [SA-list] DHCP Errors
When a DHCP client sends out a DHCPREQUEST and the DHCP server(s) respond with a DHCPOFFER. BUT since this is based on broadcasts this will only "show" DHCP server that are within the same broadcast segment. (exception to that is when you have a DHCP/BOOTP relay agent which can forward the request to a DHCP server in another segment too)
You would then need to be able to have a list of valid DHCP servers and compare the responses you get to those that are within the list. If there an answer from a server that is not within the list, there is a "problem" (or better a new dhcp server).
That's the logic to follow, so all you have to do now is to write an external check for this :-)
Good luck.
Dirk.
From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] On Behalf Of Tobie Fysh
Sent: Friday, January 21, 2005 11:29 AM
To: '[email protected]'
Subject: [SA-list] DHCP Errors
Hi everybody,
Okay this is going to sound like a laugh but last night one of our techs was playing about with a build of a test server and installed a DHCP server onto it (Win2K3), he built it onto different IP range so this morning some PC's decided to start looking at this server instead of our normal one leading to problems all over the place.
My question is - Can SA check for new DHCP servers being added to the network? (We've got a rogue department who install stuff as well as technicians who do!!)
Regards,
Tobie Fysh
Powerone Media
Security Tip: When possible, use a passphrase instead of a password.
