How to detect rouge DHCP servers in a network with Linux

^{Created: 2018-11-26 00:26:38 | Last modified: 2018-11-28 20:37:08} ^{| By: Nova}
^{Access: Read}^{| Visibility: Public}^{| Views: 229}^{| Rating: N/A}^{| Tags: dhcp linux}
This is how to detect rouge DHCP servers in a network using a Linux host

Install a distro of Linux with nmap installed (yum install nmap). Tested on Centos 7 (doesn't work on Centos 6)

Example:

nmap --script broadcast-dhcp-discover -e eth0

Example with timeout of 90 seconds

nmap --script broadcast-dhcp-discover --script-args "broadcast-dhcp-discover.timeout=90" eth0

The result:

From here you can see all of the DHCP info including the server where the DHCP result came from

More options: https://mwhubbard.blogspot.com/2015/03/trouble-shooting-dhcp-with-nmap.html

Note: Dnsmasq DHCP

To get a list of DHCP leases when using /etc/init.d/dnsmasq

cat /var/lib/misc/dnsmasq.leases