Scenario / Problem Definition:-
We are a software development center with development and test labs, occasionally (unintentionally ) we have users setup a dhcp / ddns server for their testing purposes either as a vm or physical machine. This disrupts or interferes with the production setup and causes a denial of service / intermittent connectivity issues to production systems as well as Internet usage. Though at the network switch level they have enabled ( dhcp snooping) which would avoid the rogue server disrupt other networks, it still brings down the current VLAN it is setup on. (In our case for example a single floor with 95 users can be impacted).
Microsoft has an implementation to avoid this scenario - http://social.technet.microsoft.com/wiki/contents/articles/25660.how-to-prevent-rogue-dhcp-servers-on-your-network.aspx . Likewise most networking vendors also .
The case differs in our situation where we have dual boot systems. Linux users as well as people who do not always login into a Domain Controller.
There are a number of scanners /tools , but an integrated approach with our OS can quickly help the Sysadmin / network admin identify and resolve the issue as soon as possible.

Comments