How do I find if there is a rogue DHCP server on my Network?
Solution 1:
One simple method is to simply run a sniffer like tcpdump/wireshark on a computer and send out a DHCP request. If you see any offers other then from your real DHCP server then you know you have a problem.
Solution 2:
To recap and add to some of the other answers:
Temporarily disable your production DHCP server and see if other servers respond.
You can get the IP address of the server by running ipconfig /all on a windows machine, and then you can get the MAC address by looking for that IP address using arp -a.
On a Mac, run ipconfig getpacket en0 (or en1). See http://www.macosxhints.com/article.php?story=20060124152826491.
The DHCP server information is usually in /var/log/messages. sudo grep -i dhcp /var/log/messages*
Disabling your production DHCP server might not be a good option, of course.
Use a tool that specifically looks for rogue DHCP servers
See http://en.wikipedia.org/wiki/Rogue_DHCP for a list of tools (many of which were listed in other responses).
Configure switches to block DHCP offers
Most managed switches can be configured to prevent rogue DHCP servers:
http://www.cisco.com/en/US/docs/switches/lan/catalyst6500/ios/12.2SX/configuration/guide/snoodhcp.html
http://www.juniper.net/techpubs/en_US/junos9.2/topics/concept/port-security-dhcp-snooping.html
Solution 3:
dhcpdump, which takes input form tcpdump and shows only DHCP related packets. Helped me find rootkited Windows, posing as fake DHCP in our LAN.
Solution 4:
The Wireshark / DHCP explorer / DHCP Probe approaches are good for a one time or periodic check. However, I'd recommend looking into DHCP Snooping support on your network. This feature will provide constant protection from rogue DHCP servers on the network, and is supported by many different hardware vendors.
Here's the feature set as indicated in the Cisco docs.
• Validates DHCP messages received from untrusted sources and filters out invalid messages.
• Rate-limits DHCP traffic from trusted and untrusted sources.
• Builds and maintains the DHCP snooping binding database, which contains information about untrusted hosts with leased IP addresses.
• Utilizes the DHCP snooping binding database to validate subsequent requests from untrusted hosts.
Solution 5:
dhcploc.exe is the quickest and handiest way on Windows systems. It is available in the XP Support Tools. The Support Tools are on every OEM/retail XP disk, but may or may not be on "recovery disks" provided by some OEMs. You can also download them from MS.
It's a simple commandline tool. You run dhcploc {yourIPaddress} and then press the 'd' key to do a fake discovery. If you leave it running without pressing any keys, it will display every DHCP request and answer it hears. Press 'q' to quit.