I recently had a case where an end user thought it would be a good idea to connect their home router into the network to overcome “a lack of ports in their office”. Need the less say this caused havoc for the other users on that site as it started issuing DHCP addresses on another subnet!
I had to quickly track out where this device was on the network using a combination freeware tool called ‘Rogue DHCP Server Detection’ and LLDP commands on HP ProCurve switches. Note the Rogue DHCP Server Detection tool is subnet based to make sure you are able to use it on the same subnet as the rogue device.
If you already know it’s mac-address then feel free to skip ahead but as I didn’t and only knew it’s IP I had to get it’s mac-address.
I knew there was a Debian Linux box at site so I SSH’ed onto that, added another IP to the interface to bring it onto the same subnet as the rogue device, then try and ping the device which luckily responded! Now to hunt in the arp tables for it’s mac-address BINGO I now had it’s mac-address. The commands I used are below.
1. root@WiFiSquid:~# ip addr add dev eth0 192.168.1.254/24 2. root@WiFiSquid:~# ping -i eth0 192.168.1.254 4. root@WiFiSquid:~# arp -a | grep 192.168.1.254 ? (192.168.1.254) at a4:b1:e9:38:a7:4e [ether] on eth0
5. Remember to remove the temporary IP before disconnecting!!
ip addr del dev eth0 192.168.1.254/24
Now these steps will vary depending on your environment but I had roughly 12 switches to hunt through to track it down so I have condensed it for this article.
Connect to the first switch you wish to victimise
HP-Switch-1# show mac-address a4b1e9-38a74e Status and Counters - Address Table - a4b1e9-38a74e Port ------- 50
It’s on an uplink port (or on another switch somewhere else on the network)
What is on port 50?
HP-Switch-1# show lldp info remote-device LLDP Remote Devices Information LocalPort | ChassisId PortId PortDescr SysName --------- + ------------------------- ------ --------- ---------------------- 50 | 58 20 b1 c2 2b 80 6 6 HP-Switch-2
Hop onto the switch in the ‘SysName’ IP can be found by running
show lldp info remote all this doesn’t show up on tab completion! Just rinse and repeat what we did above until you find it.
HP-Switch-1# show lldp info remote all LLDP Remote Device Information Detail Local Port : 50 ChassisType : mac-address ChassisId : 58 20 b1 c2 2b 80 PortType : local PortId : 6 SysName : HP-Switch-2 System Descr : HP J9584A 3800-24SFP-2SFP+ Switch, revision KA.15.15.0012... PortDescr : 6 Pvid : 1 System Capabilities Supported : bridge, router System Capabilities Enabled : bridge Remote Management Address Type : ipv4 Address : 192.168.9.10 Poe Plus Information Detail Poe Device Type : Type2 PSE Power Source : Unknown Power Priority : Unknown Requested Power Value : 0 Watts Actual Power Value : 0 Watts
HP-Switch-2# show mac-address a4b1e9-38a74e Status and Counters - Address Table - a4b1e9-38a74e Port ------- 18
From the above we can see our device is on port 18 of switch 2. I then shut the port down to stop it from issuing anymore IPs.
HP-Switch-2# conf t HP-Switch-2(config)# interface 18 HP-Switch-2(eth-18)# disable
Of course this will differ but the principle will be the same.