Detect rouge DHPC server - Revision history

Pio2pio at 22:28, 12 August 2019

2019-08-12T22:28:30Z

← Older revision		Revision as of 00:28, 13 August 2019
Line 78:		Line 78:


	[[Category:Linux]]		[[Category:Linux]][[Category:Nmap]]

Pio2pio: /* Step 2. Wireshark */

2014-06-08T18:54:20Z

Step 2. Wireshark

← Older revision		Revision as of 20:54, 8 June 2014
Line 65:		Line 65:
	> lan config --dhcpserver enable		> lan config --dhcpserver enable

	==== Step 2. Wireshark ====		== Step 2. Wireshark ==

	*Install Wireshark		*Install Wireshark

Pio2pio: /* Step 1. Nmap scanning */

2014-06-08T18:54:07Z

Step 1. Nmap scanning

← Older revision		Revision as of 20:54, 8 June 2014
Line 15:		Line 15:
	Then I have rebooted the router to restart dhpc server. It start working as it should. The router was up for 9 days. Therefore I have started looking for a way to detect rouge DHCP server.		Then I have rebooted the router to restart dhpc server. It start working as it should. The router was up for 9 days. Therefore I have started looking for a way to detect rouge DHCP server.

	==== Step 1. Nmap scanning ====		== Step 1. Nmap scanning ==

	*Billion router scanned with NMAP when DHCP was ON:		*Billion router scanned with NMAP when DHCP was ON:

Pio2pio at 18:53, 8 June 2014

2014-06-08T18:53:48Z

← Older revision		Revision as of 20:53, 8 June 2014
Line 3:		Line 3:
	Jul 25 09:51:18 192.168.1.254 DHCP SERVER: DHCPINFORM from 192.168.1.126		Jul 25 09:51:18 192.168.1.254 DHCP SERVER: DHCPINFORM from 192.168.1.126
	Jul 25 09:51:19 192.168.1.254 DHCP SERVER: DHCPINFORM from 192.168.1.111		Jul 25 09:51:19 192.168.1.254 DHCP SERVER: DHCPINFORM from 192.168.1.111
	Jul 25 09:52:51 192.168.1.254 DHCP SERVER: DHCPDISCOVER from 8c:70:5a:66:2e:a4 via br0		Jul 25 09:52:51 192.168.1.254 DHCP SERVER: DHCPDISCOVER from 8c:70:5a:11:22:33 via br0
	Jul 25 09:52:52 192.168.1.254 DHCP SERVER: DHCP offer to 8c:70:5a:66:2e:a4		Jul 25 09:52:52 192.168.1.254 DHCP SERVER: DHCP offer to 8c:70:5a:11:22:33
	'''Jul 25 09:52:52 192.168.1.254 DHCP SERVER: Exiting as another DHCP server is found'''		'''Jul 25 09:52:52 192.168.1.254 DHCP SERVER: Exiting as another DHCP server is found'''
	Jul 25 09:57:48 192.168.1.254 syslog: web: logout (timeout)		Jul 25 09:57:48 192.168.1.254 syslog: web: logout (timeout)
Line 25:		Line 25:
	67/udp open\|filtered dhcps		67/udp open\|filtered dhcps
	68/udp closed dhcpc		68/udp closed dhcpc
	MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)		MAC Address: 00:04:ED:BB:CC:DD (Billion Electric Co.)

	*Then DHCP server possibly can be disabled with when ssh'd to the router with its busybox command (see below Busybox section)		*Then DHCP server possibly can be disabled with when ssh'd to the router with its busybox command (see below Busybox section)
Line 40:		Line 40:
	67/udp open\|filtered dhcps		67/udp open\|filtered dhcps
	68/udp closed dhcpc		68/udp closed dhcpc
	MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)		MAC Address: 00:04:ED:BB:CC:DD (Billion Electric Co.)

	Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds		Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
Line 50:		Line 50:
	67/udp open\|filtered dhcps		67/udp open\|filtered dhcps
	68/udp closed dhcpc		68/udp closed dhcpc
	MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)		MAC Address: 00:04:ED:BB:CC:DD (Billion Electric Co.)

	So, looking at nmap report we cannot definitely say that dhpc server has been disabled. Let's dig further.		So, looking at nmap report we cannot definitely say that dhpc server has been disabled. Let's dig further.

Pio2pio: /* Step 2. Wireshark */

2014-05-26T20:24:31Z

Step 2. Wireshark

← Older revision		Revision as of 22:24, 26 May 2014
Line 78:		Line 78:


	[[Category:~~All~~]]		[[Category:Linux]]

Pio2pio: /* Step 1. Nmap scanning */

2013-08-03T11:44:32Z

Step 1. Nmap scanning

← Older revision		Revision as of 13:44, 3 August 2013
Line 27:		Line 27:
	MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)		MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)

	*Then DHCP server disabled with command		*Then DHCP server possibly can be disabled with when ssh'd to the router with its busybox command (see below Busybox section)
	> lan config --dhcpserver disable		> lan config --dhcpserver disable

Line 51:		Line 51:
	68/udp closed dhcpc		68/udp closed dhcpc
	MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)		MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)

			So, looking at nmap report we cannot definitely say that dhpc server has been disabled. Let's dig further.

	* Billion router busybox interface		* Billion router busybox interface

Pio2pio: /* Step 2. Wireshark */

2013-07-28T15:29:16Z

Step 2. Wireshark

← Older revision		Revision as of 17:29, 28 July 2013
Line 74:		Line 74:
	[[File:Bootp.option.type53.png\|none\|600px\|thumb\|left\|Bootp.option.type53]]		[[File:Bootp.option.type53.png\|none\|600px\|thumb\|left\|Bootp.option.type53]]
	For more reference please visit Wireshark Wiki http://wiki.wireshark.org/DHCP		For more reference please visit Wireshark Wiki http://wiki.wireshark.org/DHCP


			[[Category:All]]

Pio2pio: /* Step 1. Nmap scanning */

2013-07-25T22:36:23Z

Step 1. Nmap scanning

← Older revision		Revision as of 00:36, 26 July 2013
Line 62:		Line 62:
	lan --help		lan --help
	> lan config --dhcpserver enable		> lan config --dhcpserver enable

			==== Step 2. Wireshark ====

			*Install Wireshark

			sudo apt-get install wireshark

			*To be able to configure capturing on interfaces run as root. It is not recommended and alternative way to run the application is included in its manual.

			*We are only interested with the DHCP traffic, so on the display filter type: '''bootp.option.type == 53''' and click apply.
			[[File:Bootp.option.type53.png\|none\|600px\|thumb\|left\|Bootp.option.type53]]
			For more reference please visit Wireshark Wiki http://wiki.wireshark.org/DHCP

Pio2pio at 21:33, 25 July 2013

2013-07-25T21:33:42Z

@@ Line 1: / Line 1: @@
 *Billion router scanned with NMAP when DHCP was ON:
@@ Line 18: / Line 34: @@
   Nmap done: 1 IP address (1 host up) scanned in 1.40 seconds
   $ sudo nmap -sU 192.168.1.254 -p 67-68
   Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-25 12:25 BST
   Nmap scan report for home.gateway.home.gateway (192.168.1.254)
@@ Line 29: / Line 44: @@
   Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
   $ sudo nmap -sU 192.168.1.254 -p 67-68
   Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-25 12:25 BST
   Nmap scan report for home.gateway.home.gateway (192.168.1.254)

Pio2pio at 12:08, 25 July 2013

2013-07-25T12:08:46Z

← Older revision		Revision as of 14:08, 25 July 2013
Line 3:		Line 3:
	*Billion router scanned with NMAP when DHCP was ON:		*Billion router scanned with NMAP when DHCP was ON:

	Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-25 12:24 BST		Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-25 12:24 BST
	Nmap scan report for home.gateway.home.gateway (192.168.1.254)		Nmap scan report for home.gateway.home.gateway (192.168.1.254)
	Host is up (0.00042s latency).		Host is up (0.00042s latency).
	PORT STATE SERVICE		PORT STATE SERVICE
	67/udp open\|filtered dhcps		67/udp open\|filtered dhcps
	68/udp closed dhcpc		68/udp closed dhcpc
	MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)		MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)

	*Then DHCP server disabled with command		*Then DHCP server disabled with command
Line 16:		Line 16:
	*The router has been rescanned		*The router has been rescanned

	Nmap done: 1 IP address (1 host up) scanned in 1.40 seconds		Nmap done: 1 IP address (1 host up) scanned in 1.40 seconds
	$ sudo nmap -sU 192.168.1.254 -p 67-68		$ sudo nmap -sU 192.168.1.254 -p 67-68

	Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-25 12:25 BST		Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-25 12:25 BST
	Nmap scan report for home.gateway.home.gateway (192.168.1.254)		Nmap scan report for home.gateway.home.gateway (192.168.1.254)
	Host is up (0.00036s latency).		Host is up (0.00036s latency).
	PORT STATE SERVICE		PORT STATE SERVICE
	67/udp open\|filtered dhcps		67/udp open\|filtered dhcps
	68/udp closed dhcpc		68/udp closed dhcpc
	MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)		MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)

	Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds		Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
	$ sudo nmap -sU 192.168.1.254 -p 67-68		$ sudo nmap -sU 192.168.1.254 -p 67-68

	Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-25 12:25 BST		Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-25 12:25 BST
	Nmap scan report for home.gateway.home.gateway (192.168.1.254)		Nmap scan report for home.gateway.home.gateway (192.168.1.254)
	Host is up (0.00040s latency).		Host is up (0.00040s latency).
	PORT STATE SERVICE		PORT STATE SERVICE
	67/udp open\|filtered dhcps		67/udp open\|filtered dhcps
	68/udp closed dhcpc		68/udp closed dhcpc
	MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)		MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)

	* Billion router busybox interface		* Billion router busybox interface