DHCP Rogue Servers

Can anybody help me with this.
I know you can authorise DHCP servers within the forest
so that nobady can install another unauthorised one that
may disrupt addressing.

However, how does (if is does) the client know to only
get its IP addresses from an authorised DHCP server?

Is this a configurable item?

Also, how does it know where to find them?

The reason I ask is that we need (an imperative)to use
DHCP. We are on a closed, but shared, network system
(i.e. no internet connectivity) but there may be other
legitimate DHCP servers out there (on the WAN somewhere)
that could give out the wrong IP parameters.

In a brief DHCP works as under: Below is assuming a newly
set up client, which has never before obtained any IP, and the DHCP
lease below was successful.

The client on boot, sends DHCPDISCOVER packet on
ip 255.255.255.255. with return ip of 0.0.0.0
(Like Client is asking is anybody out there who can assing me an IP)

Now if there is a BOOTP Relay Agent (DHCP relay agent) in the subnet, it
passes the requirests on local as well as on other subnets too.
If there are other subents, but no Relay Agent in the subnet where client
exists, the packet will reach only to the DHCP Server
in the same subnet.

DHCP Servers, then send DHCPOFFER packet to the
client. (Yes, I am here, would you like an IP address from me?)

If the cleint receives many offers it will chose randomly one (if it has
never before obtained
an IP) and will send DHCPREQUEST requesting offered parameter from one
server (randomly
chosen, well there may be some preference it gives here, if yes I dunno.)
and declining offers from
others.

The DHCP server then sends DHCPACK .. informing committed IP and other
optional parameters.

Next time, when the cleint is rebooted, it prefers the same IP which was
obtain previously, and thus
would go to the same DHCP server if other DHCP server do not have that IP in
their scope.

To solve your problem you have 3 options depending upon your network setup.

1. If all clients support BOOTP protocol, it can be configured to use a
specific DHCP server
but then you must configure each client, if add new client it should support
BOOTP etc.

2. Configure the router in the subnet in question to use a specific DHCP
server.
If you have thrid party router(s), supporting relay agent then it should
be configured
and the Set the IP Helper Address to the DHCP Server Address you wish.

If using Microsoft Router (i.e. NAT .. Routing and Remote Access then add
DHCP Relay Agent
in Routing and Remote Access, (for this start Routing and Remote Access,
expand, IP Routing,
Select General, Right cleick on it, select new routing protocool and select
DHCP Relay Agent.
Then in DHCP Relay Agent add the interface to wich this relay agent should
bind (which will be
your LAN interface). Then Right click on DHCP Relay Agent, select
Properties, and under
DHCP Server, give the IP off the DHCP server you wish.)

3. If all clients of your interest are on same subnet, and thus you really
not need a BOOTP / DHCP
Relay Agent, then disable the Relay Agent every where, where it is, like on
routers, Servers etc.

Sharad


"Jon WM" <(E-Mail Removed)> wrote in message
news:30a701c3e276$4793c230$(E-Mail Removed)...
> Can anybody help me with this.
> I know you can authorise DHCP servers within the forest
> so that nobady can install another unauthorised one that
> may disrupt addressing.
>
> However, how does (if is does) the client know to only
> get its IP addresses from an authorised DHCP server?
>
> Is this a configurable item?
>
> Also, how does it know where to find them?
>
> The reason I ask is that we need (an imperative)to use
> DHCP. We are on a closed, but shared, network system
> (i.e. no internet connectivity) but there may be other
> legitimate DHCP servers out there (on the WAN somewhere)
> that could give out the wrong IP parameters.