IP Networking

I need a script to scan the surrounding DHCP servers. I want to know how many dhcp servers are there on my connected etnernet.

Mrm. A script won't help you. Something like nmap would be your tool of choice. I'm thinking this is what you want to use (run as root):

Code:

nmap -oN /tmp/dhcp-discovery.txt -sU -p 67,547 10.2.11.0/24  10.2.0.0/16

Change the portion in blue to match your subnet/bits-in-mask.

Then grep the results:

Code:

grep -B4 open /tmp/dhcp-discovery.txt

If your grep doesn't support "-B", try:

Code:

egrep "(^Interesting)|( open)" /tmp/dhcp-discovery

And you'll see output like:

Code:

Interesting ports on 10.2.11.88:
Interesting ports on 10.2.11.205:
67/udp open|filtered dhcps
Interesting ports on 10.2.11.210:
Interesting ports on 10.2.11.211:
Interesting ports on 10.2.11.212:

And the line in red is the one you're interested in.

Thanks dud, I have tried your recommendation. I got a lot of ip addresses on my network as result. I didn't understand that which one is dhcp offer,discover or inform packages. It only shown dhcp open or closed. I'm just looking for the ip address that the dhcp packages are offered. only offered packages not discover or inform packages.

I found script that is searching dhcp offer packages. DHCP offer packages mean DHCP server.


Script is on related link. roguedetector - Revision 29: /trunk/RogueDetect It have dependency : libconfig, libnet, libnet-devel, libpcap. You can read README file.

Wireshark is searching DHCP offer, discover and inform packages. We must write bootp on filter box.