Is it possible to detect a rogue DHCP server through GenieACS?

Help
1

Hi everyone,

I’d like to know if there’s any way, using GenieACS or TR-069, to identify whether there’s another device on the customer’s LAN acting as a DHCP server (a rogue DHCP server).

I’m dealing with cases where it appears that another device is handing out IP addresses, causing network conflicts. I’d like to know if it’s possible to detect this remotely from the managed CPE.

I understand that TR-069 doesn’t normally expose LAN DHCP broadcast traffic, but I was wondering if anyone has implemented a solution for this, or if any vendors expose proprietary parameters that could help detect a rogue DHCP server.

Has anyone faced this situation before or found a reliable approach?

Thanks in advance!

2

Check the AddressSource on the Hosts parameter. If its set to DHCP then the router handed out the IP addr. If Static, then there is a good chance something else is handing out DHCP.