How would we detect and locate a rogue DHCP server on our local area network?
You can use an nmap script for locating a server that will send DHCPOFFER (so long as it's in your broadcast domain):
nmap --script broadcast-dhcp-discover
This will give DNS domain name, your IP, who offered it, lease info..all of the fun stuff.
You can also include a list of hosts that have anything to do with port 67:
nmap --script broadcast-dhcp-discover -p67 [your network CIDR]
The answer to this will largely depend on how good the management software on your network is.
Assuming that it's reasonable, I'd say that this wold be done by looking at the MAC address of the packets from the rogue server and then reviewing the management interface for your switches to see which port that MAC address is connected to. Then trace from the port to the physical port and see what's connected...
If you have no way to map from MAC address --> switch port --> physical port this could be a bit tricky, especially if the person running the server doesn't want to be found.
You could do a quick ping sweep of your network using nmap (nmap -sP -v -n -oA ping_sweep [your network here]) that'd give you a map of IP addresses to MAC addresses, then (assuming your rogue is on there) you could port scan the IP address and see if it tells you anything about it (e.g. machine name from SMB ports)...
Just found the rogue dhcp server on my home lan by the classic method of trial and error. Looking at the network properties I found that some dhcp clients got an ip address in the rogue 192.168.1.x range instead of the 192.168.3.x range that I configured in my dhcp server.
First I suspected a dev pc that hosts some virtual machines; the configuration is complex and who knows there might be some dhcp server in one of those vm's. Just pull the network cable and see if that dhcp client now gets a valid ip address. No improvement, too bad.
Now I suspected the "smart" tv, its a samsung and that brand is known for spying on viewers. Pulled its network cable. No luck, though.
Then, after some looking around I thought of that little old adsl modem with 4 ethernet ports I got some months ago from a friend to replace a broken ethernet switch. Pulled the 12 volt adapter cable. Bingo! The problem dhcp client now gets a valid ip address! I also realized that the dhcp trouble in our house started a while ago.
Agreed, I was not smart enough to fiddle with tools like nmap and/or wiresnark. But did Sherlock Holmes not succeed with Deduction and Induction?
With a straightened paper clip I did a factory reset on the old adsl modem to make the default linksys password work, and disabled the dhcp server on it.
You can use wireshark to listen for dhcp replies to requests then go to your switch's arp table to find the address and location. You can do this with most configurable switches.