PacketLens — Rogue DHCP Hunt

Briefing

Cogwheel Commons is a members' makerspace. Since this morning, everyone on the lab‑floor segment (VLAN 40, 10.40.0.0/24) keeps dropping off the internet — laptops grab an address, then route nowhere. Priya, the on‑call netops volunteer, thinks a member plugged a pocket travel router into a floor jack and it's now answering DHCP faster than the real server on some renewals.

Your job: capture the DHCP exchange on your own port, force a fresh lease, and tell the real lease server from the imposter. Compare every Offer against the documented baseline in the Exhibit panel.

Interface

idle — 0 frames

Capture must be running before a filter narrows anything.

#	Time	Source	Proto	Summary
Capture is idle. Press Start capture to begin sniffing on eth-floor3.

Select a packet to expand its protocol tree.

Your NIC · eth-floor3

MAC 02:1A:9C:40:3F:11

Lease: none — interface idle

Exhibit · documented baseline (lab-floor)

Authorized DHCP server	10.40.0.5 · dhcp-core01
Default gateway	10.40.0.1
DNS resolver	10.40.0.2
Lease time	86400 s (24 h)
Search domain	cogwheel.lan
Client pool	10.40.0.50 – 10.40.0.199

Task checklist

Start a packet capture on eth-floor3 — the toolbar capture button
Narrow the view to DHCP traffic with a display filter — bootp, or udp.port 67/68
Force a fresh lease (release, then renew) to trigger DORA — Offers only appear on a live exchange
Open both DHCP Offer packets and read the Server Identifier + options
Flag the offer that doesn't match the baseline as rogue

Questions

Q1Which IP address is the rogue DHCP server?

Q2According to the Exhibit, what is the lab-floor's correct default gateway?

Q3Of the rogue's offered values, which is the strongest single tell that it's hijacking traffic, not just misconfigured?

It hands out a 24-hour lease. It lists itself (10.40.0.137) as the default gateway. It assigns addresses inside 10.40.0.0/24. It answers broadcast DHCP Discover frames.

Q4Which switch feature, enabled on access ports, drops DHCP Offers arriving from untrusted ports — stopping this rogue cold?

Q5The lab-floor subnet is 10.40.0.0/24. How many usable host addresses does it provide?

Callsign / handle

Pseudonym only. This lab never collects your name, email, or student ID.

Progress 0 / 10