Rogue DHCP servers can wreak havoc in enterprise environments, particularly when unmanaged switches are involved. The classic symptoms include:

• Interrupted PXE boot processes (as in the original case)
• Clients receiving IPs outside the approved range
• Intermittent network segmentation
• DNS resolution failures

When physical inspection fails, try these technical approaches:

1. Packet Sniffing with tcpdump

sudo tcpdump -i eth0 -vvv -s 1500 '((port 67 or port 68) and (udp))' -w dhcp.pcap

2. DHCP Fingerprinting with nmap

nmap --script broadcast-dhcp-discover -e eth0

3. DHCP Lease Analysis

Compare legitimate DHCP server responses with rogue ones:

When dealing with unmanaged switches:

1. Create a temporary VLAN using port-based isolation

   
   # Cisco example (if you eventually get managed switches)
   interface range fastEthernet 0/1-24
    switchport mode access
    switchport access vlan 999
   

2. Use ARP poisoning detection

   
   arpwatch -i eth0 -f /var/lib/arpwatch/arp.dat
   

Python script to monitor DHCP traffic:

#!/usr/bin/env python3
from scapy.all import sniff, DHCP

def dhcp_monitor(pkt):
    if pkt.haslayer(DHCP):
        if pkt[DHCP].options[0][1] == 2:  # DHCP Offer
            print(f"DHCP Offer from {pkt[IP].src}")
            # Add validation logic here

sniff(filter="udp and (port 67 or 68)", prn=dhcp_monitor)

For stubborn cases:

• Use TDR (Time Domain Reflectometer) to locate unauthorized cabling
• Implement 802.1X port authentication where possible
• Check for VLAN hopping vulnerabilities

Rogue DHCP servers can wreak havoc in enterprise environments by:

• Assigning incorrect IP configurations to clients
• Causing IP address conflicts
• Breaking PXE boot sequences (as mentioned in the original case)
• Redirecting traffic through malicious gateways

The most reliable method involves capturing DHCP traffic:

# tcpdump command for DHCP traffic
tcpdump -i eth0 -v -n port 67 or port 68 -w dhcp_capture.pcap

Key fields to examine in Wireshark:

• DHCP Option 54 (Server Identifier)
• DHCP Message Type (Offer/Ack)
• Source MAC addresses

Here's a Python script using Scapy to identify rogue servers:

from scapy.all import *
from scapy.layers.dhcp import DHCP

def detect_rogue_dhcp(pkt):
    if DHCP in pkt and pkt[DHCP].options[0][1] == 2:  # DHCP Offer
        server_ip = pkt[BOOTP].siaddr
        if server_ip not in ["10.0.0.1", "192.168.1.1"]:  # Known good servers
            print(f"Rogue DHCP detected! IP: {server_ip}, MAC: {pkt.src}")
            
sniff(filter="udp and (port 67 or port 68)", prn=detect_rogue_dhcp)

For unmanaged switches, consider these physical approaches:

1. Perform a binary search by disconnecting switch halves
2. Use ARP scanning to map IPs to switch ports
3. Check for unexpected MAC addresses in the ARP table

For larger networks, implement these protections:

• DHCP Snooping on managed switches
• Port security with MAC address limiting
• 802.1X authentication for network access

To safeguard your thin clients:

# Example iPXE script with DHCP server validation
:dhcp_check
dhcp || goto net_fail
isset ${netX/dhcp/server} || goto no_dhcp
echo Valid DHCP server at ${netX/dhcp/server}
boot || goto boot_fail