On Thursday, 2005-08-25 at 11:48 MST, Martin Mkrtchian <dotsecure@xxxxxxxxx> wrote: > We are migrating from Lucent QIP to MetaIP for DHCP services and so > far we have had two issues when MetaIP has been implemented for VLAN > that has an unauthorized Linksys router giving out IP addresses. > > Is there a scanning tool out there that can determine if there are > unauthorized Linksys (type) routers in a specific VLAN? First you say you have a problem with rogue dhcp servers (don't we all?), then you way you're looking for routers. For the rogue dhcp server problem, there are 2 types of this problem, but unfortunately the solutions I've found aren't quite as specific to dhcp as I would like. Blocking at layer 3 (router) is relatively easy - you can block traffic to 68/udp except from your official dhcp servers. Blocking at layer 2 is harder. Here is a suggestion for doing it on Cisco switches (which might not work on low end equipment - haven't tried that - the switches must support vlan filtering): Using vlan filtering, define that rogue traffic is dropped and logged; all other traffic is forwarded: vlan access-map dhcpmap 10 match ip address rogue_dhcp action drop log vlan access-map dhcpmap 20 match ip address any_host action forward exit An access list that matches all traffic: ip access-list standard any_host remark Provide a match (permit) for all traffic permit any exit An access list that matches rogue dhcp traffic. (With Cisco's strange vlan access mechanism, it requires that we appear to be blocking the valid traffic and allowing the bad stuff. But, in conjunction with the access-map, just the opposite occurs.) ip access-list extended rogue_dhcp remark Provide a match (permit) for dhcp responses from rogue servers deny udp host 10.1.32.21 any eq bootpc ! these are my official dhcp servers deny udp host 10.1.32.22 any eq bootpc ! likewise deny udp 10.1.0.0 0.0.252.7 any eq bootpc ! my routers, that might be relaying legitimate dhcp permit udp any any eq bootpc ! the match that will catch the rogues deny ip any any ! don't catch anything else exit Apply this setup to the vlans supported by my dhcp servers: vlan filter dhcpmap vlan-list 64-128,136-140,146,232 The way this works it could result in blocking some traffic that you really don't want to (for example, if any of your users employ PIXIE to load some of their machines). If so, you will need to add the addresses of those server machines to the filter as though they were official dhcp servers - so that their bootpc traffic is not blocked. Tony Rall
