Detecting a competing DHCP service

Help docker
1

I run PiHole +DHCP at home but my ISP will from to time update the firmware in my modem and will re-enable the DHCP service on that.

Can anyone suggest a robust method of detecting the change/ that a competing DHCP is in operation ?

For more detail, I have to run PiHole in a service container

....

ExecStart={ path=/usr/bin/docker ; argv=/usr/bin/docker start -a pihole ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ;
ExecStartPost={ path=/usr/bin/docker ; argv=/usr/bin/docker exec pihole pihole -a enabledhcp 192.168.1.200 192.168.1.240 192.168.1.254 24
ExecStop={ path=/usr/bin/docker ; argv=/usr/bin/docker exec pihole pihole -a disabledhcp ; ignore_errors=yes ; start_time=[n/a] ; stop_tim
ExecStop={ path=/usr/bin/docker ; argv=/usr/bin/docker stop -t 2 pihole ; ignore_errors=no ; start_time=[n/a] ; stop_time=[n/a] ; pid=0 ;

so it seems to me that I might restart the pihole container regularly and add an execstartpre step to run a check and inhibit the enabledhcp action

so details of a check?

3

Have you tried googling rogue DHCP alert? If you know what SPAN is, that might be the right direction. I, for one, don't know what SPAN is.

1 Like
4

Pi-hole itself is able to list all DHCP servers on the link(s) it is connected to

pihole-FTL dhcp-discover

I'd guess it may also be the most reliable tool to do so yet - see also the discussion in Reliably detect all DHCP servers on a network? that lead to Pi-hole supporting it.

However, since you would run that command from within some kind of container or virtualised environment, it would depend on that environment's network configuration whether pihole-FTL would see just the virtual network or your actual network link. It would only work for the latter.

1 Like
5

turns out that the way I chose to network inside docker ( macvlan ) will pass the dhcp-discover out to the network
thus
/usr/bin/docker exec pihole pihole-FTL dhcp-discover
does the trick
Thank You Very Much