How to find the DHCP server on a network

[A.L.M.Buxey at lboro.ac.uk]

Hi,
> One of the networks I am responsible for has a DHCP server that is
> giving out an address already assigned to another host. I want to locate
> this DHCP server and investigate it as a rogue server. 
> Can someone suggest a clean way to identify the DHCP servers on a
> network?

enable dhcp information trusted on the vlans on your
router and turn on DHCP snooping on your switches - if
your kit can support this. syslog or snmp traps will then 
show you the switch port that the server is on.

alternatively, use a DHCP client in debug mode, stick
yourself on that network and see the DHCP replies
being sent to you (or to this system thats being given wrong
details) - the DHCP response will contain details such as
MAC address....alternatively wireshark etc when doing DHCP
and see where the responses come from.

there are some rogue DHCP server sniffers out there - but
most havent seen new code for some time and dont compile
cleanly anymore :-(

alan