Как найти dhcp server

наличие двух серверов. при каждом запросе ip-адреса от клиента он будет получать его от того сервера, пакет от которого успел раньше прийти.
избежать конфликтов ip-адресов. при назначении вручную – вести список назначенных адресов, не выдавать пользователям прав на изменение ip-адресов. при назначении автоматическом – настроить DHCP-сервер (один), не выдавать пользователям прав на изменение ip-адресов, не допускать появления в сети других DHCP-серверов (защитить сетевые коммутаторы от постороннего доступа, использовать на коммутаторах DHCP-snooping, если поддерживается).
найти лишние DHCP-сервера. запустить на компьютере Wireshark. заставить компьютер переполучить ip-адрес (например, вытаскиванием патчкорда). проанализировать результат. если ответы на запрос пришли с разных MAC-адресов – посмотреть, какой MAC-адрес у правильного DHCP-сервера; остальные, следовательно, лишние. дальше их можно искать, если у вас управляемые коммутаторы, на них можно посмотреть, какому физическому порту коммутатора назначен MAC-адрес лишнего DHCP-сервера.

I recently received an email from a reader asking “How do I find the IP address of my DHCP server”? My initial reaction was “Hmmm, good question”. That lead me to investigate the fastest way to find your DHCP server IP address from the Linux command line.

What is a DHCP Server?

A DHCP Server is a system on a network that manages dynamic configuration of client systems on the network. DHCP (Dynamic Host Configuration Protocol) is a standard network protocol used on almost all IP networks. It allows for dynamic configuration of network parameters on systems connected to the network. Before DHCP an administrator would have to configure each system individually. For more information on DHCP, see the Resource and Links section below.

How to Find Your DHCP Server IP Address

There is no simple command to show the IP address of the DHCP server on the network. However, there are places it is recorded, if you know where to look. Here are a few ways you can find the IP address of a DHCP server on your network.

NOTE: You will need root or sudo access to run all of these commands.

Find DHCP Server IP Using grep to Find Log Entries

The first method I thought of was to check the logs for the DHCPOFFER. The DHCPOFFER packet would come from the DHCP server and should be written to your logs. Here we use grep with some options (-I to ignore binary files, -R for recursive) to find the log file entry that contains our DHCP server IP address.

CentOS 7 example:

[[email protected] ~]$ sudo grep -IR "DHCPOFFER" /var/log/*
 /var/log/anaconda/syslog:17:15:00,299 INFO dhclient:DHCPOFFER from 10.0.0.1

Fedora 30 example:

[[email protected] ~]$ sudo grep -IR "DHCPOFFER" /var/log/*
 /var/log/anaconda/journal.log:Apr 03 20:02:33 localhost-live dhclient[2464]: DHCPOFFER from 10.0.0.1

Ubuntu 19.04 example:

[email protected]:~$ sudo grep -IR "DHCPOFFER" /var/log/*
/var/log/syslog:Oct 12 10:15:55 ubuntu1904 dhclient[864]: DHCPOFFER of 192.168.122.204 from 192.168.122.1 

NOTE: Notice that every distribution stores it in a different log file? That is why we recursively search the whole /var/log/ directory.

Using Journalctl and grep

You can do the same as above using journalctl.

[[email protected] ~]$ sudo journalctl | grep -m1 DHCPACK
 Apr 20 21:46:28 putor dhclient[1506]: DHCPACK from 10.0.0.1 (xid=0x65f93c03)

To learn more about using journalctl read “Viewing logs with journalctl”.

Find DHCP Server IP Address using Leases File

The dhclient utility stores your lease information in leases file. These lease files are kept in different places for different distros, software loads, and different versions.

Common locations:

/var/lib/dhcp/dhclient.[interface].leases
/var/lib/dhcp3/dhclient.leases

NOTE: Replace [interface] with the name of your network interface (i.e. eth0, eno1, etc..)

Now use grep to find the DHCP server.

[[email protected] ~]$ sudo grep -m1 "dhcp-server" /var/lib/dhcp/dhclient.eno1.leases
   option dhcp-server-identifier 10.0.0.1;

If you are using NetworkManager, you can find the lease file location by looking at the running processes (ps aux).

[[email protected] ~]$ ps aux | grep NetworkManager
 root       967  0.0  0.1 620636 20348 ?        Ssl  10:14   0:00 /usr/sbin/NetworkManager --no-daemon
 root      2603  0.0  0.0  15176  9016 ?        S    10:15   0:00 /sbin/dhclient -d -q -sf /usr/libexec/nm-dhcp-helper -pf /var/run/dhclient-eno1.pid -lf /var/lib/NetworkManager/dhclient-dd040512-708c-3858-97c6-d79e66458e36-eno1.lease -cf /var/lib/NetworkManager/dhclient-eno1.conf eno1

Now that you know where the leases file is, you can get the DHCP server IP address from that file.

[[email protected] ~]$ sudo grep -m1 "dhcp-server" /var/lib/NetworkManager/dhclient-dd040512-708c-3858-97c6-d79e66458e36-eno1.lease
   option dhcp-server-identifier 10.0.0.1;

We can string both of these operations together to simplify the process.

[[email protected] ~]$ sudo cat $(ps aux | grep -o '[/]var/lib/NetworkManager/S*.lease') | grep -m1 dhcp-server-identifier
   option dhcp-server-identifier 10.0.0.1;

Find DHCP Server IP Using dhclient Utility

Another way would be to use the dhclient utility with some options. This also requires root or elevated privileges. The drawback of this is that the dhclient will go through the whole DHCP D.O.R.A. process. This also means that your DHCP server, network and client system need to be configured correctly. This is not much help if you are troubleshooting DHCP issues.

[[email protected] ~]$ sudo dhclient -d -nw eno1
 Internet Systems Consortium DHCP Client 4.3.6
 Copyright 2004-2017 Internet Systems Consortium.
 All rights reserved.
 For info, please visit https://www.isc.org/software/dhcp/
 Listening on LPF/eno1/34:e6:d7:0f:a9:83
 Sending on   LPF/eno1/34:e6:d7:0f:a9:83
 Sending on   Socket/fallback
 DHCPDISCOVER on eno1 to 255.255.255.255 port 67 interval 7 (xid=0x1e69d667)
 DHCPREQUEST on eno1 to 255.255.255.255 port 67 (xid=0x1e69d667)
 DHCPOFFER from 10.0.0.1
 DHCPACK from 10.0.0.1 (xid=0x1e69d667)
 bound to 10.0.0.2 -- renewal in 3287 seconds.

Conclusion

There you have it, a few different methods to find the IP address of your DHCP server. I am sure there are other ways, as with anything in Linux. If you know of another way please leave it in the comments and I will update the article.

Resources and Links

• DHCP (Dynamic Host Configuration Protocol) – Wikipedia

Иногда при разборе чужой сети требуется определить насколько правильно работает сеть и нет ли там чужих DHCP серверов.

Делается это довольно просто. Для этого можно использовать небольшую утилитку RogueChecker (см. аттач). Автор ее Subhash Badri. Основную страничку с утилитой можно посмотреть тут, скачать утилиту тут.

Скачиваем, запускаем, видим такое окошко: