From: Joel VanderWerf <vjoel@...>
Date: 2009-03-18T06:10:55+09:00
Subject: Re: detect rogue DHCP server

Eleanor McHugh wrote:
> On 17 Mar 2009, at 11:15, Chris Henderson wrote:
>> I want to write a program to detect rogue DHCP server on my (switched)
>> network. It would broadcast a "dummy" MAC address and see which DHCP
>> server responds. My idea is to send a DHCPDISCOVER packet and see
>> which DHCP server sends an ACK packet (but never acknowledge the ACK
>> and terminate the connection).
>>
>> How do I go about writing this in Ruby?
>>
>> Thanks for any suggestions.
> 
> First up grab a copy of RFC 2131 (assuming it's still current, this 
> isn't my area of expertise) and implement the protocol with Ruby's 
> bit-struct library (see the Camping presentation linked from my .sig for 
> some basic info on bit-struct). You'll want to use a raw socket for 
> sending the DHCPDISCOVER and there's some basic coverage of them in the 
> Pickaxe but if you're not familiar with network programming a copy of 
> Stevens' UNIX Networking Programming will come in handy.

FWIW, bit-struct includes a couple of raw socket examples.

http://redshift.sourceforge.net/bit-struct/

-- 
       vjoel : Joel VanderWerf : path berkeley edu : 510 665 3407