MikroTik Tutorial 74 - How to Identify Rogue DHCP Servers

Learn MikroTik RouterOs Tutorial Series (english)
A rogue DHCP server is a DHCP server on a network which is not under the administrative control of the network staff. It is a network device such as a modem or a router connected to the network by a user who may be either unaware of the consequences of their actions or may be knowingly using it for network attacks such as man in the middle.

[@marcust331]

Thanks for the video. How do you block the rouge DHCP server/Router? I can't find the Mac address the alert gave, but I do see something on the 192.168.1.x network. If I can't block it, how would I add the 192.168.1.x network to my 10.100.0.x network to try to configure it remotely via the VPN?

[@asdfgghfd2041]

I am really happy i managed to find your channel in the internet full of crap. Really nice job man, now i am watching your movies one by one. Thank you for sharing your knowledge !

[@htwebhost2417]

Good to find your videos I have subscribed I deploy mikrotik to my clients good to find a channel with useful info I have already learned a lot and your videos have given me some ideas to help me optimize my current configs. Thanks!

[@maximusinnase9278]

I ve sever issue on the DHCP
Constructed , Hotspot on network , as DHCP passes in interface 6. Clients are managed through the wireless network in 5 GHz channel.
Now I get the problem in as the rouge dhcp , are shown in my logs .
I can get mac address and IP address(thats the ip and MAC of clients home router).
I use the the rule ........ to drop.
chain=forward action=drop src-mac-address=A8:32:9A:00:3F:4C log=no log-prefix=""
but cannot drop the MAC or IP as well.
So whats the next solution.

[@maximusinnase9278]

shows logs as ..................... 14:23:17 echo: dhcp,critical,error dhcp alert on ether6-Hotspot/Static: discovered unknown dhcp server, mac A8:32:9A:00:3F:4C, ip 192.168.10.1

[@wDave1337]

Thank you for great video. I have a question for you, do you have any idea how to solve exact problem on pfSense platform?

[@TKSJa]

You are welcome. No I don't use pfsense.

[@P90Camper]

Thank you very much! Is there a way to grab the MAC and IP of the rouge in the email?

[@mehdishah1219]

how can i access my router remotely out of your network... plz guide

[@antreastsigkis4709]

Hello Sir, very nice and extremely helpful video.Good job.Can you please share with us the script that you used for alerts.Thank you in advance

[@abessolostevy1790]

hello thank for your video
please can you do a video how to configure a snmp on mikrotik router ?

[@aesluxuryapartments116]

Thank you for this tutorial.
Please i wish if you could teach us how to block windows update with Mikrotik.

[@TKSJa]

Noted.

[@gunchag]

+1
This could be very useful.

[@Rouly88]

Yes man. Cool tutorial.. Very important

[@TKSJa]

Thanks

[@nikolashuminosky6987]

Have you got script like i want to disable the interface in the bridge who reach the dhcp-server.

[@TKSJa]

No I don't, but doing that might bring your network down.

[@green-media-pl]

Great! This is what I need!

[@TKSJa]

Good!!

[@PristineAnimation]

thank you very much sir

[@jatinsinghal9859]

Great,, i need this settings

[@wellingtonayiera4455]

Help me deal with rogue dhcp servers

[@blueconetion3466]

tanks

[@TKSJa]

You are welcome.