<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META http-equiv=Content-Type content="text/html; charset=utf-8">
<META content="MSHTML 6.00.6000.16481" name=GENERATOR></HEAD>
<BODY>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=666175401-11072007>Indeed. Looking at the source of dhcpdetector.pl (<A
href="https://svn.bountysource.com/roguedetect/trunk/dhcpdetector.pl">https://svn.bountysource.com/roguedetect/trunk/dhcpdetector.pl</A>)
it shouldn't be too hard to modify it into a nagios plugin (trivial
even).</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=666175401-11072007></SPAN></FONT> </DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=666175401-11072007>The relevant code block:</SPAN></FONT></DIV>
<DIV dir=ltr align=left><FONT face=Arial color=#0000ff size=2><SPAN
class=666175401-11072007><PRE>sub send_log {
my $severity = shift @_;
my $message = shift @_;
if (!$message) {
$message = 'ERROR: No Message Recieved, logging failure';
}
# If the above conditions are met and
# the send_msg is set then go ahead and
# log it using the specified log mojo
if ($syslog_level >= $severity) {
syslog('LOG_INFO',$message);
}
if ($email_level >= $severity) {
send_mail($alert_email,"[RogueDetect] Log Report",$message);
}
if ($page_level >= $severity) {
send_mail($page_email,"RogueDetect Failure!",$message);
}
if ($print_level >= $severity) {
print $message . "\n";
}
</SPAN></FONT><FONT face=Arial><FONT color=#0000ff><FONT size=2></FONT></FONT></FONT></PRE><PRE><FONT><FONT><FONT face=Arial><FONT color=#0000ff><FONT size=2>Shou<SPAN class=666175401-11072007>ld be fairly easy to hook into this, print the correct message and set an exit code from here....</SPAN></FONT></FONT></FONT></FONT></FONT><BR></PRE></DIV>
<DIV class=OutlookMessageHeader lang=en-us dir=ltr align=left>
<HR tabIndex=-1>
<FONT face=Tahoma size=2><B>From:</B> nagios-users-bounces@lists.sourceforge.net
[mailto:nagios-users-bounces@lists.sourceforge.net] <B>On Behalf Of </B>Rogelio
Bastardo<BR><B>Sent:</B> Wednesday, 11 July 2007 4:12 AM<BR><B>To:</B> Hari
Sekhon<BR><B>Cc:</B> Nagios Users mailinglist<BR><B>Subject:</B> Re:
[Nagios-users] using Nagios to detect rogue DHCP servers?<BR></FONT><BR></DIV>
<DIV></DIV>
<DIV>
<BLOCKQUOTE class=gmail_quote
style="PADDING-LEFT: 1ex; MARGIN: 0px 0px 0px 0.8ex; BORDER-LEFT: #ccc 1px solid"><BR>requires
a whole new plugin written from scratch, I haven't seen a<BR>tcpdump like
plugin. Therefore much more difficult and more time <BR>required, as well as
more computationally intensive to watch all traffic<BR>for another dhcpoffer,
when actually you'll get the same result.</BLOCKQUOTE>
<DIV><BR class=webkit-block-placeholder></DIV>
<DIV><BR class=webkit-block-placeholder></DIV>
<DIV>What about writing a custom plugin that uses this GPL prog to return the
warning/critical/ok/pending values?</DIV>
<DIV><BR class=webkit-block-placeholder></DIV>
<DIV><A
href="https://roguedetect.bountysource.com/">https://roguedetect.bountysource.com/</A></DIV>
<DIV><BR class=webkit-block-placeholder></DIV>
<DIV>From the website:</DIV>
<DIV><BR class=webkit-block-placeholder></DIV>
<DIV>Rogue Detect sends <SPAN class=caps>DHCPDISCOVER </SPAN>packets to the
network and listens for <SPAN class=caps>DHCP</SPAN> servers to respond and
checks responses against authorized dhcp servers. It’s written in Perl. By
default it supports sending reports to syslog, email, standard out or a customer
script of your chosing. Each reporting method has it’s own independent
reporting level.</DIV>
<DIV><BR class=webkit-block-placeholder></DIV>
<DIV>Their wiki is here: <A
href="https://roguedetect.bountysource.com/wiki">https://roguedetect.bountysource.com/wiki
</A></DIV>
<DIV><BR class=webkit-block-placeholder></DIV>
<DIV>notes at the bottom of the wiki:</DIV>
<DIV><BR class=webkit-block-placeholder></DIV>
<DIV>"Sending a <SPAN class=caps>DHCPDISCOVER</SPAN> packet causes any <SPAN
class=caps>DHCPSERVERS</SPAN> listning to allocate an IP address for a few
seconds, while they wait for the detector to <SPAN class=caps>ACK</SPAN> their
offer. Since we never do send an <SPAN class=caps>ACK</SPAN>, the IP is not
allocated to us. Hence, it should be ok to run this on the network.. but do so
at your <SPAN class=caps>OWN RISK</SPAN>!!</DIV>
<P>This package is nice in that you do not have to have a clear view of the
network to run it (ie, it works behind a switch). You DO have to be within
broadcast range, which usually means on the same subnet as the <SPAN
class=caps>DHCP</SPAN> server. In some cases scaning port 68 (67?) on every
machine may be the better answer to finding dhcp servers, but with this program,
as apposed to a passive one like snort, you do not have to be able to see
traffic not destined for you."</P>
<DIV><BR class=webkit-block-placeholder></DIV>
<DIV><BR class=webkit-block-placeholder></DIV>
<DIV><BR class=webkit-block-placeholder></DIV>
<DIV><BR class=webkit-block-placeholder></DIV></DIV></BODY></HTML>