# Detect rogue DHCP server

**URL:** <https://www.ruby-forum.com/t/detect-rogue-dhcp-server/163105>\
**Category:** Ruby\
**Created:** [March 17, 2009, 12:18pm UTC](https://www.ruby-forum.com/t/detect-rogue-dhcp-server/163105 "2009-03-17T12:18:38Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![bigdaddy71](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/bbe5ce/32.png) [@bigdaddy71](https://www.ruby-forum.com/u/bigdaddy71)\
**Post date:** [March 17, 2009, 12:18pm UTC](https://www.ruby-forum.com/t/detect-rogue-dhcp-server/163105/1 "2009-03-17T12:18:38Z")

</div>

I want to write a program to detect rogue DHCP server on my (switched)  
network. It would broadcast a “dummy” MAC address and see which DHCP  
server responds. My idea is to send a DHCPDISCOVER packet and see  
which DHCP server sends an ACK packet (but never acknowledge the ACK  
and terminate the connection).

How do I go about writing this in Ruby?

Thanks for any suggestions.

---

<div class="post-metadata">

**Author:** ![bigdaddy71](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/bbe5ce/32.png) [@bigdaddy71](https://www.ruby-forum.com/u/bigdaddy71)\
**Post date:** [March 17, 2009, 1:19pm UTC](https://www.ruby-forum.com/t/detect-rogue-dhcp-server/163105/2 "2009-03-17T13:19:52Z")

</div>

On 17 Mar 2009, at 11:15, Chris H. wrote:

> I want to write a program to detect rogue DHCP server on my (switched)  
> network. It would broadcast a “dummy” MAC address and see which DHCP  
> server responds. My idea is to send a DHCPDISCOVER packet and see  
> which DHCP server sends an ACK packet (but never acknowledge the ACK  
> and terminate the connection).
> 
> How do I go about writing this in Ruby?
> 
> Thanks for any suggestions.

First up grab a copy of RFC 2131 (assuming it’s still current, this  
isn’t my area of expertise) and implement the protocol with Ruby’s bit-  
struct library (see the Camping presentation linked from my .sig for  
some basic info on bit-struct). You’ll want to use a raw socket for  
sending the DHCPDISCOVER and there’s some basic coverage of them in  
the Pickaxe but if you’re not familiar with network programming a copy  
of Stevens’ UNIX Networking Programming will come in handy.

In the presentation we also cover the use of libpcap for watching on-  
the-wire traffic and that’s probably the way to go for detecting the  
ACK packet if you have the privileges to put your NIC in promiscuous  
mode.

You’ll also find a slew of network code of varying quality scattered  
through the other linked presentations and some of that may give you  
inspiration: the UDP client examples in the “Semantic DNS” and “Shoes”  
presentations are particularly lightweight and should (with a big “I’m  
guessing without writing the code myself” disclaimer) apply equally to  
raw sockets.

Ellie

## Eleanor McHugh Games With Brains [http://slides.games-with-brains.net](http://slides.games-with-brains.net)

raise ArgumentError unless @reality.responds\_to? :reason

---

<div class="post-metadata">

**Author:** ![bigdaddy71](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/bbe5ce/32.png) [@bigdaddy71](https://www.ruby-forum.com/u/bigdaddy71)\
**Post date:** [March 17, 2009, 3:48pm UTC](https://www.ruby-forum.com/t/detect-rogue-dhcp-server/163105/3 "2009-03-17T15:48:28Z")

</div>

On 17 Mar 2009, at 13:50, lists wrote:

> > should (with a big “I’m guessing without writing the code myself”  
> > disclaimer) apply equally to raw sockets.
> 
> Ellie, you generously reference your slides pretty frequently. Had  
> you ever given thought to fleshing out some of your ideas in a book  
> or downloadable pdf?

I’d love to if I can find the time to do it justice 🙂

Ellie

## Eleanor McHugh Games With Brains [http://slides.games-with-brains.net](http://slides.games-with-brains.net)

raise ArgumentError unless @reality.responds\_to? :reason

---

<div class="post-metadata">

**Author:** ![bigdaddy71](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/bbe5ce/32.png) [@bigdaddy71](https://www.ruby-forum.com/u/bigdaddy71)\
**Post date:** [March 17, 2009, 2:53pm UTC](https://www.ruby-forum.com/t/detect-rogue-dhcp-server/163105/4 "2009-03-17T14:53:38Z")

</div>

On Mar 17, 2009, at 7:16 AM, Eleanor McHugh wrote:

> apply equally to raw sockets.  
> Ellie, you generously reference your slides pretty frequently. Had  
> you ever given thought to fleshing out some of your ideas in a book or  
> downloadable pdf?

---

<div class="post-metadata">

**Author:** ![bigdaddy71](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/b/bbe5ce/32.png) [@bigdaddy71](https://www.ruby-forum.com/u/bigdaddy71)\
**Post date:** [March 17, 2009, 10:13pm UTC](https://www.ruby-forum.com/t/detect-rogue-dhcp-server/163105/5 "2009-03-17T22:13:59Z")

</div>

Eleanor McHugh wrote:

> First up grab a copy of RFC 2131 (assuming it’s still current, this  
> isn’t my area of expertise) and implement the protocol with Ruby’s  
> bit-struct library (see the Camping presentation linked from my .sig for  
> some basic info on bit-struct). You’ll want to use a raw socket for  
> sending the DHCPDISCOVER and there’s some basic coverage of them in the  
> Pickaxe but if you’re not familiar with network programming a copy of  
> Stevens’ UNIX Networking Programming will come in handy.

FWIW, bit-struct includes a couple of raw socket examples.

[http://redshift.sourceforge.net/bit-struct/](http://redshift.sourceforge.net/bit-struct/)