Can OnPlus detect rogue DHCP servers?

Question

On one of my customer's networks I seem to be getting a lot of duplicate IP addresses being detected.  Assuming these messages are valid, I suspect there are additional DHCP server(s) on the network somewhere.  It's a physically large building owned by a church with one flat (layer 2) network (wired and wireless) including different types of users (students, retired nuns, office workers, clergy).  There are lots of opportunities for someone to connect nearly anything to the network.
I would like to be able to detect these possible rogue DHCP servers.  Can the OnPlus that I have installed there help me?  It has been nearly impossible to find the devices with dupes based on MAC address so far.
Thanks.

Answer 1

Hi Chris,
ON100 supports rogue DHCP server detection by default (search OnPlus documentation for ROGUE DHCP events). The default behavior is that the ON100 learns the available DHCP servers on the network whenever the ON100 (re)boots, and if ever it sees broadcast DHCP server replies from a different source IP than the ones that were available, it will trigger this type of event. Unfortunately, if the rogue DHCP server is already present when the ON100 is booted on the network, the ON100 will consider it as pre-existing and therefore won't consider it as an invalid DHCP server.
You can override this simplistic behavior by adding an explicit DHCP monitor to one or more hosts on the network, this gives the ON100 a definitive list of authorized DHCP servers, and then only if a truly rogue DHCP server appears should you see these events.
The Duplicate IP monitor is a separate monitor altogether than the DHCP monitor (which additionally provides the rogue DHCP server detection) and doesn't necessarily indicate a rogue DHCP server on the network. I understand that misconfigured windows servers with ICS enabled are a common source of rogue DHCP servers on networks.
-mike