Ok, welcome back.
In this segment, we will talk about DHCP servers.
Again however, we were going to talk about the concept of rogue DHCP server.
A rogue DHCP server is very common on networks today.
Believe it or not, it's not necessarily a black hat hacker infiltrating your network
and attempting to place a server on your network
to corrupt your clients with data so that it can spoof and so on and so forth.
A rogue DHCP server can be a router that you deploy,
DHCP configured on the actual device as well as placing that on a segment with,
where there is already a DHCP server. That's an example.
Another example is a lot of Apple-based systems
as they are being used and brought into networks more and more.
Generally, sometimes it's a BYOB type of thing where people are bringing them in.
It's not necessarily locked down by IT and they had DHCP servers configured on them.
Another example, people want to set up their own wireless segment.
So, they set this up on the network which you could lock down and take out.
But if it was something that they were able to set up,
they can configure this and they can also start doughing out addresses
and cause problems on your network.
So as you could see, it's not necessarily this, this anomaly that's on your network.
You know, you're taking security classes, the concept of a rogue DHCP server
would be one where you would assume somebody was setting up for malicious reasons.
Yes, that does happen.
However, rogue DHCP server can also be set up accidentally.
And by doing so, clients may start responding
with it and to it, and it may respond to those clients and give it information and
therefore doesn't connect to or participate on your network.
And why is this an issue?
Well, if you want to have your clients participate on a network correctly
and access their resources, essentially what you will do is
you will give it an IP that works on that subnet.
On that segment, give a DNS server so that it can resolve its web browsers and applications
and file shares and so on. Send the email and if a rogue is deployed
it will get information that may not have that, those assignments in it.
And will create what's considered to be an outage on that segment.
And depending on the size of the segment, it could be quite a large outage.
So, just remember a rogue DHCP server
is something that could possibly take down your network, your clients,
disable them from being able to use resources.
And it is definitely more common than you may think or know or
you may already be seeing this pretty often.
So, what is, why is it an issue?
It breaks the appropriate logical addressing scheme on your subnet
if it's not configured identically.
If clients do not get, this is primarily for Windows clients,
if they do not or not able to get a DHCP server, they will flip to APIPA and be on that range.
It's also something to look out for.
But essentially, what that means is it's completely disconnected
from your enterprise network.
Your client may not be able to access resources, shares, email, so on and so forth.
And it could also be, in my opinion, the least
common security violation where somebody will actually set up a server on that segment
to re-route that client to some spoof material.
So just remember that it could be intentional and it could be accidental.
So that being said, this is what it would look like on the network.
I flagged it here in red. Essentially, I'd put it on the local segment.
And what's happening here is it may be responding to that client
before it can get its information from another client.
Now, one of the key things here is you
may have to have the client time out on its lease.
A lot of times if it's for example, Windows, you can IP config, release for new,
and clear the IP information, you will try to request another IP.
It may pull it from the rogue and there you go.
If it's not on a correct, if it does not have the correct settings,
it could quite possibly cause you some disruption.
So Wireshark analysis of a rogue DHCP, very, very easy to see.
So when you actually run the capture and you collect it up,
you will start seeing through the door process. You will see primarily that your source
and destination information here, if you're looking at the capture,
and you know that your DHCP server's on another segment,
you know what the IP address is.
If you're seeing it show up as a different IP address,
it's likely that it's a rogue.
And what's nice about that is you could start looking through the MAC table,
looking through your ARP table and try to find which port
this rogue is on and you could find it and disable it
or take it off your network and stop it from responding to your clients.
Another way you can stop this is or help prevent this
is by configuring snooping on your Cisco devices.
I've put the router or the device config
in here so that you could see it's very simple, IP DHCP snooping.
We'll look for and help to prevent rogue DHCP servers.
However, if you do not have this configured
and this does gets through and you do have rogue on your network,
it's likely that you can use Wireshark
to quickly look at this source and destination addresses
and if does not match your DHCP server
it's likely that you have a rogue
and you will be able to trace it down
through looking at IP resolution, ARP cache, MAC address table
down to port, find out the source and disconnect it from your network.
And or you can prevent it completely by using port security
and not allowing things to be connected to your network that you do not know about.
That is extremely helpful tool.
It will allow you to provide a high level
of security to your network so that on
ports that have not been opened and authorized for use
somebody may not be able to just simply stick
a wireless router which has a DHCP router on it.
It will not allow you to connect the hub
which could create a loop and take down your network and so on and so forth.
In here lastly is just the zoom in
on the, where you see the source and destination.
As we mentioned if you're seeing packets come from a DHCP server,
that is not recognizable, that is likely your rogue.