Re: dhcp investigation

[Seth Arnold <sarnold@willamette.edu>]

* mikhail malamud <mikhail.malamud@drexel.edu> [010127 20:16]:
> Everything was well up until today, someone possibly decided to run
> their own dhcp server. I guess due to the nature of DHCP protocol,
> dhclient picks up an ip from the first dhcp server it finds. I assume
> that whoever runs "auxiliary" dhcp server is giving out 0.0.0.0 address
> to all its clients because once in a while I get the following message
> pop up on the console:

Try using tcpdump (available in the ports tree) -- you can give some
command line arguments to filter out broadcast packets only to see who
is handing out the bogus dhcp leases. The tcpdump manpage describes
pretty well how to write the filters.

-- 
``Oh Lord; Ooh you are so big; So absolutely huge; Gosh we're all
really impressed down here, I can tell you.''