Warning Signs of a Rogue DHCP Server

| | No TrackBacks
There may be more than one DHCP server in a network; care should be taken when setting several DHCP servers, to prevent dynamic/etc address space overlapping and subsequent IP address conflicts.

The following could start happen if there are conflicts in DHCP servers settings:

  • workstations begin to lose their IP addresses, other settings (DNS, for example)
  • workstations report IP addresses conflicts
  • DHCP-related traffic grows significantly (UDP ports 67 and 68)

However, the above, in case you are sure your DHCP service is set up properly, may also be a sign of a rogue (unauthorized) DHCP server running within your network. Primary goal of such a server is providing false DNS addresses, thus redirecting connections to dangerous locations; possible consequences may be virus and other malware distribution - they can be detected by malware/antivirus scanners in you network.

The traits above should not be neglected; also, proper monitoring of the crucial resources and related traffic might also be a good idea.

No TrackBacks

TrackBack URL: /blog/mt-tb.cgi/26

blog comments powered by Disqus

About this Entry

This page contains a single entry by Konstantin Boyandin published on December 10, 2009 9:26 AM.

Changing the IP Address of a Server was the previous entry in this blog.

How To: Choose a VPN Auth Protocol is the next entry in this blog.

Find recent content on the main index or look in the archives to find all content.