invisible Dhcp server

[sebastianVD]

Hi,
I have a rogue dhcp server on the network and can not find it.With wireshark i found an ip and mac address, i can not ping the ip or connect to it. When i look on the cisco switch the mac adress is on a port connected to the proxmox server. On this port i have 4 mac addresses, 2 of vm's and 2 i do not know.
I checked, they are not vm mac addresses, i checked all the vm nics.
I also checked in linux with ip -a. and to no avail.
Is it possible the is some hidden server? Or dhcp service on the proxmox linux?

 

[Alwin]

Not by default, but packages are available in the repositories. You can use the PVE firewall to filter out the unwanted MAC addresses. There are also MAC lookups online, so you might be able to get the vendor, if it helps.

 

[sebastianVD]

No vendor, so probably virtual mac. How can i see if a dhcp is running on the proxmox?
How do i enable the mac filter, i do not see it on the web interface.
Regards

 

[Alwin]

How can i see if a dhcp is running on the proxmox?

Look for service, ports. https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol

How do i enable the mac filter, i do not see it on the web interface.

Best through the command line. https://pve.proxmox.com/pve-docs/chapter-pve-firewall.html

 

[sebastianVD]

I found the problem, shut down the virtial servers one by one and while shutting down one of the servers the other two mac addresse where gone as well.
Now i will try to find out what kind of software was installed on this server, no windows dhcp.
regards.

 

[sebastianVD]

softether vpn app was installed on this server, and setup as a dhcp server, with a virtuel ip adress not on our network.
Mac adress was a virtual mac of this software.
Thanks for your help.