I wanted to take the service down for a couple minutes (5 tops) to test if there was rogue DHCP on the network.

She argued that when the service was restarted it would force all the clients to renew their IPs as soon as the service came live.

I argue that is incorrect as, by my understanding of DHCP, the clients would not notice that the service had stopped unless they asked to renew their IP during the time it was down.

Also, they would not notice the service start up because DHCP, to the best of my knowledge, only talks to the clients when a client asks for a new IP or to renew its IP.

So my question is.

Upvoted This thread is archived New comments cannot be posted and votes cannot be cast Sort by best.

Share Report Save level 2 Public K-12 Technology Director 4 years ago Yes.

Now, why cant OP just use Wireshark and find their rogue DHCP server instead of taking down a production service without notice during working hours 16 Share Report Save Continue this thread level 2 Linux Admin Original Poster 4 years ago Thanks.

I thought so. Im fine with being wrong, thats how one learns but she made me second guess myself.

Share Report Save Continue this thread level 1 Sr.

SysadminInfosec 4 years ago When you find the person who plugged a linksys box into their office so they could have their own private WLAN, send them here for 40 lashes too.

Share Report Save level 2 Linux Admin Original Poster 4 years ago Weve had that a few times over the years.

We go hunting with big sticks to beat them.

Share Report Save level 2 4 years ago To stop them from doing that; Step (1) Implement DHCP Guard on your switches, and only trust the access ports belonging to legitimate servers.

Step (2) setup your LAN firewall to only allow outgoing DNS requests to your company approved DNS servers.

Step (3) arrange for the TTL of DNS response packets from your internal DNS servers to have a TTL of 1 (Probably by mangling the packet via IPtables), so any unauthorized router inserted will cause DNS reply packets to end up getting lost with TTL Expired.

Anyways. they might try plugging in the Linksys box for their own private LAN, But at this point, they should discover that they have no internet access, and hopefully give up.

Share Report Save Continue this thread level 2 4 years ago Problem is when you get the people who like it when you give them the forty lashes.

Share Report Save Continue this thread level 1 Founder, Manitonetworks.com 4 years ago There is no interaction between the DHCP service and client unless the client is requesting a new renewed address.

You could shut your DHCP service off for an hour or two, and assuming none of your clients are broadcasting for a new address, they would never know the service went offline.

Share Report Save level 1 LinuxUnix Sysadmin 4 years ago She argued wrong.

Send her here for 40 lashes.

Share Report Save level 1 4 years ago Had an issue with rogue DHCP on a network one time.

Rather than restarting the DHCP service, we used a packet sniffer to find that someone was using a home router as a hub at their desk and it was acting as DHCP server.

Share Report Save level 2 4 years ago So if I disable DHCP in my router(just to add more ports) there wont be any issue -2 Share Report Save Continue this thread level 1 4 years ago If you want to force clients to renew their leases, then you need to send a DHCP NAK packet for every hardware address on the LAN.

Share Report Save level 2 Good Enough IT is not good enough.

Share Report Save level 1 4 years ago A little beside the point, but maybe if youre worried about a rogue dhcp server you should implement dhcp snooping on your switches.

Even the Netgears I have the pleasure of configuring support it.

Share Report Save level 1 4 years ago edited 4 years ago These DHCP lease is client side.

This means if you reset the DHCP server, the client will simply be reassigned their dynamic address.

Share Report Save level 1 4 years ago May I suggest dhcping for i in 1.254; do dhcping -s 192.168.1.i; done 1 Share Report Save level 1 01001101 4 years ago Client computers ONLY care about DHCP at the half life of their current lease (and subsequent halve lives), when they are forced to get a new address, or when they are getting an address for the first time.

You could chcuck the DHCP server off a cliff into a volcano and build a new one.

End points wont request a new address till one of the conditions above are true.

In short. Restarting the service will do nothing.

Share Report Save level 1 Infrastructure Engineer 4 years ago It wont, but it may erase the leases in the DB that could cause duplicate addresses when hosts restart.

Turn on DHCP snooping on your switches to solve this properly.

DB that could cause duplicate addresses when hosts restart.

Dhcping Windows