Rogue detection: DHCP Server

 

Rogue DHCP server detection is an important aspect of network security and management. In a typical network environment, DHCP (Dynamic Host Configuration Protocol) servers are used to automatically assign IP addresses and other network configuration details to client devices. However, the presence of an unauthorized or rogue DHCP server can disrupt network operations and pose significant security risks.

DDI Central identifies and promptly alerts about rogue servers that are assigning IP addresses to a subnet. This kind of attack involves a rogue DHCP server issuing lease requests to clients with invalid or inappropriate IP addresses and/or option parameters. Such "man in the middle" attacks might aim to improperly configure client devices by altering default gateway settings or DNS server addresses. Conducting regular IP address sweeps or discoveries is an effective way to detect rogue devices, including unauthorized DHCP servers.

The image shows that DDI Central has issued a red warning alert, indicating the detection of a rogue server at 1.1.1.6. This server has been actively listening and responding to address requests within the specified subnet. You can locate the infected endpoint using advanced endpoint security solutions and quarantine it immediately.

+-
Back to Top