RE: Hacker on Internal Net: DHCP

I just noticed a rogue DHCP lease on my network and began searching
for the MAC address and found the post below from 22 Mar 2005. I also
found an explanation for the behavior on Microsoft's website:
http://support.microsoft.com/kb/945948/en-us

------- 2005 post from Ivyhu...@xxxxxxxxx -------
I'm noticing this same thing on my network since recently adding M$
Windows Server 2003 in our network... I've been searching the net
high
and low for a reason why these DHCP leases are made and have found
nothing. Is there any new info I'm missing?

Here's the bogus MAC's I'm seeingin our DHCP lease reports:

MACHINE | IP | MAC | LEASE BEGIN | LEASE
END
detective 192.168.0.119 45:3b:13:0d:89:0a 14:47:45 02/23/2005 14:48:45
02/23/2005
detective 192.168.0.117 e9:eb:b3:a6:db:3c 14:47:29 02/23/2005 14:48:29
02/23/2005
detective 192.168.0.118 4d:c8:43:bb:8b:a6 14:47:37 02/23/2005 14:48:37
02/23/2005

WTF?? I hate M$!!!!! Any reason for why my logs are getting spammed
would be appreciated. When we do a company security audit, I'd prefer
not to answer "uhh I dunno".

-Scott
------- End Prior Post -------
.

Relevant Pages

  • Re: Missing System Tray Items in Xp
    ... and we will see if the systray icons disappear again. ... Thanks again, John ... Check "My Network Places" and on the left hand side under ... In searching the net I find that this problem seems to have been around ...
    (microsoft.public.windowsxp.general)
  • Static AND dhcp on same NIC?
    ... I also need to ssh in and admin the box ... So my first thought was to try and give the box a dhcp lease on the ... primary interface (eth0) and a static address on a different network ... alias on that network. ...
    (comp.os.linux.networking)
  • RE: Check If User Exists...
    ... Well with further searching and testing I have figured out my own problem to what I figured was a simple problem. ... Here is the full code you would need to verify if a given "login name" is tied to any user in your network with VB.Net. ... "Grigs" wrote: ...
    (microsoft.public.dotnet.framework)
  • Re: Pro-active Security Software?
    ... I've been searching around the Internet, as it were, to find ideas ... > purchasing software at a reasonable price if and only if it has a fully ... > network, the hardware of which is currently in storage) and basically scan ... Open ports, filesystem problems, etc. I'm open to any suggestions on ...
    (comp.os.linux.security)
  • Re: Static AND dhcp on same NIC?
    ... I also need to ssh in and admin the box ... So my first thought was to try and give the box a dhcp lease on the ... primary interface (eth0) and a static address on a different network ... alias on that network. ...
    (comp.os.linux.networking)