DHCP Server Scanner

Find rogue DHCP servers on your network

CNetworkSecurityLinuxmacOS

A lightweight cross-platform command-line utility that scans your local network for DHCP servers. It broadcasts DHCP Discover packets, captures server responses, and displays configuration details returned by any responding servers.

Features

  • Lightweight, pure C with minimal external dependencies
  • Cross-platform support for Linux and macOS
  • Uses raw sockets (Linux) and BPF (macOS) for packet capture
  • Detects server MAC addresses, IP assignments, DNS, gateway, and subnet info
  • Fast network scanning with configurable timeout
  • Single binary with no runtime dependencies

Installation

git clone https://github.com/fycth/DHCP-server-scanner.git
cd DHCP-server-scanner
make

Usage

sudo ./bin/dhcpd-detector-release -i <interface> [-t <timeout>]

Parameters:

  • -i - Network interface (required)
  • -t - Scan timeout in seconds (default: 3)
  • -h - Show help
  • --version - Show version

Example:

sudo ./bin/dhcpd-detector-release -i eth0 -t 5

Use Cases

  • Network diagnostics - Troubleshoot DHCP-related connectivity issues
  • Security audits - Detect unauthorized/rogue DHCP servers that could redirect traffic
  • IT infrastructure monitoring - Verify expected DHCP servers are responding
  • Learning - Understand DHCP protocol mechanics hands-on

Requirements

  • Linux or macOS
  • GCC or Clang compiler
  • Make
  • Root/sudo access (required for raw packet operations)

Tech Stack

  • C - Core implementation
  • Raw sockets - Packet capture on Linux (PF_PACKET)
  • BPF - Packet capture on macOS
  • Make - Build system