DHCP Conundrum

After a few days of running into sporadic IP conflicts within one of our sub-nets, it seemed likely that there may be an unauthorized DHCP service running on our network. There are a couple of ways one could troubleshoot such a problem, the first being to disable any authorized DCHP servers and attempt to release and renew the IP address of a workstation within the subnet. (if it renews you’ll have your culprit) This solution wasn’t very appealing nor was doing such a thing during production hours. The other option was spotlighted in this well written blog article by Chip Witt “Hunting a Rogue DHCP Server” Introduced is a command-line tool called DHCPloc that comes with any Windows 2000+ resource kit. The program is easy to use, just enter your IP address and DHCPloc will output information about all DHCP servers responding to DCHP requests from the input IP address. This program allowed us to easily recognize and disable the unauthorized DHCP service. Chip Witt’s article goes into much greater detail and presents some great insight on resolving such issues.