MikroTik Tutorial 74 - How to Identify Rogue DHCP Servers

Learn MikroTik RouterOs Tutorial Series (english)
A rogue DHCP server is a DHCP server on a network which is not under the administrative control of the network staff. It is a network device such as a modem or a router connected to the network by a user who may be either unaware of the consequences of their actions or may be knowingly using it for network attacks such as man in the middle.

[@asdfgghfd2041]

I am really happy i managed to find your channel in the internet full of crap. Really nice job man, now i am watching your movies one by one. Thank you for sharing your knowledge !

[@htwebhost2417]

Good to find your videos I have subscribed I deploy mikrotik to my clients good to find a channel with useful info I have already learned a lot and your videos have given me some ideas to help me optimize my current configs. Thanks!

[@marcust331]

Thanks for the video. How do you block the rouge DHCP server/Router? I can't find the Mac address the alert gave, but I do see something on the 192.168.1.x network. If I can't block it, how would I add the 192.168.1.x network to my 10.100.0.x network to try to configure it remotely via the VPN?

[@Rouly88]

Yes man. Cool tutorial.. Very important

[@TKSJa]

Thanks

[@P90Camper]

Thank you very much! Is there a way to grab the MAC and IP of the rouge in the email?

[@mehdishah1219]

how can i access my router remotely out of your network... plz guide

[@green-media-pl]

Great! This is what I need!

[@TKSJa]

Good!!

[@maximusinnase9278]

I ve sever issue on the DHCP Constructed , Hotspot on network , as DHCP passes in interface 6. Clients are managed through the wireless network in 5 GHz channel. Now I get the problem in as the rouge dhcp , are shown in my logs . I can get mac address and IP address(thats the ip and MAC of clients home router). I use the the rule ........ to drop. chain=forward action=drop src-mac-address=A8:32:9A:00:3F:4C log=no log-prefix="" but cannot drop the MAC or IP as well. So whats the next solution.

[@maximusinnase9278]

shows logs as ..................... 14:23:17 echo: dhcp,critical,error dhcp alert on ether6-Hotspot/Static: discovered unknown dhcp server, mac A8:32:9A:00:3F:4C, ip 192.168.10.1

[@abessolostevy1790]

hello thank for your video please can you do a video how to configure a snmp on mikrotik router ?

[@aesluxuryapartments116]

Thank you for this tutorial. Please i wish if you could teach us how to block windows update with Mikrotik.

[@TKSJa]

Noted.

[@gunchag]

+1 This could be very useful.

[@antreastsigkis4709]

Hello Sir, very nice and extremely helpful video.Good job.Can you please share with us the script that you used for alerts.Thank you in advance

[@PristineAnimation]

thank you very much sir

[@wDave1337]

Thank you for great video. I have a question for you, do you have any idea how to solve exact problem on pfSense platform?

[@TKSJa]

You are welcome. No I don't use pfsense.

[@jatinsinghal9859]

Great,, i need this settings

[@wellingtonayiera4455]

Help me deal with rogue dhcp servers

[@nikolashuminosky6987]

Have you got script like i want to disable the interface in the bridge who reach the dhcp-server.

[@TKSJa]

No I don't, but doing that might bring your network down.

[@blueconetion3466]

tanks

[@TKSJa]

You are welcome.