cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
bperez
Level 10
Report Inappropriate Content
Message 1 of 5

How to detect and block a rogue DHCP Server with NSP

Hi All,

I need to create one UDS to detect and to block DHCP unauthorized in my LAN, someone has been created a UDS to detect DHCP Response and to define to exclude my Authorized DHCP? Some Ideas?

Regards.

4 Replies
msitko
Level 10
Report Inappropriate Content
Message 2 of 5

Re: How to detect and block a rogue DHCP Server with NSP

I can't think of a quick way to do that off the top of my head, but I'll recommend that you check out the Custom Attack Definitions guide to see if it is possible:

https://kc.mcafee.com/corporate/index?page=content&id=PD25595

petermason
Reliable Contributor
Reliable Contributor
Report Inappropriate Content
Message 3 of 5

Re: How to detect and block a rogue DHCP Server with NSP

Hi Bperez,

If you have a rogue DHCP server on your network you would be better off to find and remove it than trying to block it.

Peter

bperez
Level 10
Report Inappropriate Content
Message 4 of 5

Re: How to detect and block a rogue DHCP Server with NSP

Hi Peter,

I know that, but i need to be alerted at the moment if someone puts any rogue dhcp, im thinking in create one UDS signature to capture botstrap response and to exclude my legitimate dhcp servers, im researching how to make that in a uds.

Regards.

totti10
Level 9
Report Inappropriate Content
Message 5 of 5

Re: How to detect and block a rogue DHCP Server with NSP

Hi,

You can configure DHCP snooping on cisco switch to block rogue DHCP Server. You can configure interface connected to your DHCP Server as trust, so all the DHCP Offer messages from Rogue DHCP Server will be drop(because it received on untrusted Interface)

Regards!

You Deserve an Award
Don't forget, when your helpful posts earn a kudos or get accepted as a solution you can unlock perks and badges. Those aren't the only badges, either. How many can you collect? Click here to learn more.

Community Help Hub

    New to the forums or need help finding your way around the forums? There's a whole hub of community resources to help you.

  • Find Forum FAQs
  • Learn How to Earn Badges
  • Ask for Help
Go to Community Help

Join the Community

    Thousands of customers use the McAfee Community for peer-to-peer and expert product support. Enjoy these benefits with a free membership:

  • Get helpful solutions from McAfee experts.
  • Stay connected to product conversations that matter to you.
  • Participate in product groups led by McAfee employees.
Join the Community
Join the Community