How to Hunt Rogue DHCP Servers and Evil Twins on Enterprise LANs
Every sysadmin or security engineer faces the same nightmare: an unauthorized device quietly hijacking network traffic, intercepting credentials, or serving rogue IP addresses.
Whether it’s a misconfigured router brought from home or a malicious actor deploying a Pineapple device, unauthorized layer-2/layer-3 infrastructure is a high-severity threat.
Here is a practical, step-by-step technical guide to sweeping your LAN across all subnets to detect active hosts, rogue DHCP servers, and Wi-Fi Evil Twins using native Linux CLI tools.
1. Network Mapping Across All RFC 1918 Subnets
Standard ICMP ping sweeps often fail because modern desktop firewalls silently drop incoming echo requests. To map every active host across all potential private IPv4 address spaces, relying on ARP discovery and TCP/UDP SYN probing is mandatory.
The Full-Subnet ARP/Layer-2 Sweep
For your local broadcast domain, arp-scan remains the fastest tool to map layer-2 MAC-to-IP bindings:
sudo arp-scan --interface=eth0 --localnet
Probing Multi-Subnet Environments with Nmap
To sweep all private subnets (RFC 1918) without triggering port-scan alerts or waiting hours for timeouts, use Nmap’s host discovery mode (-sn) combined with ARP requests (-PR):
sudo nmap -sn -PR 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
> Pro-Tip: If traversing routed VLANs where ARP frames do not pass, drop the -PR flag and rely on TCP SYN probes targeting common management ports (80, 443, 22, 445):
> sudo nmap -sn -PS22,80,443,445 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
>
>
2. Uncovering Rogue DHCP Servers
A rogue DHCP server is one of the easiest ways for an attacker to execute a Man-in-the-Middle (MitM) attack. By serving a rogue Default Gateway or malicious DNS server IPs via DHCP options, traffic is seamlessly rerouted without raising immediate alerts.
Active Detection via Synthetic DISCOVER Packets
You can audit your broadcast domain by broadcasting a raw DHCP DISCOVER frame. If more than one server replies with a DHCP OFFER, you have a rogue server on the wire.
Using Nmap's NSE engine:
sudo nmap --script broadcast-dhcp-discover
Get Arturo Cannarozzo’s stories in your inbox
Join Medium for free to get updates from this writer.
Analyzing the Output:
Look closely at the returned server identifiers and MAC addresses.
Pre-script output results:
| broadcast-dhcp-discover:
| Response 1 of 2:
| IP Offered: 192.168.1.150
| DHCP Server: 192.168.1.1 [00:11:22:33:44:55] (Legitimate Gateway)
| Response 2 of 2:
| IP Offered: 192.168.1.220
| DHCP Server: 192.168.1.250 [DE:AD:BE:EF:00:01] <-- ROGUE DETECTED!
Passive Monitoring with dhcpdump
For continuous passive inspection of DHCP leases on an interface:
sudo dhcpdump -i eth0
3. Spotting Evil Twin Access Points
An Evil Twin mimics a legitimate Access Point's ESSID (Network Name) and often spoofing its BSSID (MAC Address). The objective is to trick client devices into auto-connecting to the stronger signal, allowing full traffic interception.
Quick Audit via NetworkManager CLI
To inspect all visible wireless networks and flag identical ESSIDs operating on different channels or BSSIDs:
nmcli dev wifi list --rescan yes
Deep Airwave Analysis using airodump-ng
For a rigorous wireless audit, switch your wireless card into monitor mode to analyze raw beacon frames:
# Enable monitor mode
sudo airmon-ng start wlan0
# Capture raw wireless frames
sudo airodump-ng wlan0mon
Key Red Flags for Evil Twins:
* Duplicate ESSIDs with differing BSSIDs: A known company SSID appearing on an unauthorized vendor MAC range.
* Signal Anomaly: A sudden spike in RSSI (dBm) for a single AP while standing far from the physical access point location.
* Mismatched Encryption: An enterprise SSID configured with standard WPA2-Personal instead of 802.1X/WPA3-Enterprise.
Summary Matrix
| Security Audit Task | Primary Tool | Tactical Command |
|---|---|---|
| All-Subnet Host Discovery | nmap | sudo nmap -sn -PR 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16 |
| Rogue DHCP Detection | nmap (NSE) | sudo nmap --script broadcast-dhcp-discover |
| Wireless Evil Twin Sweep | aircrack-ng | sudo airodump-ng wlan0mon |
Mitigating Layer-2 Risks at the Infrastructure Level
While CLI scanning tools are essential for incident response and auditing, active network hardening prevents these threats entirely:
* DHCP Snooping: Enable DHCP Snooping on your managed layer-2 switches to drop unauthorized DHCP responses on untrusted ports.
* Dynamic ARP Inspection (DAI): Pair DAI with DHCP Snooping to prevent ARP poisoning.
* 802.1X Authentication: Enforce network access control (NAC) to ensure rogue hardware cannot acquire a physical layer-2 link.
What tools or automation scripts do you use for internal network threat hunting? Let me know in the comments below!
