Rogue DHCP Server on Wireless Segment

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects potential rogue DHCP servers on a wireless segment by looking for UDP traffic on port 67 (DHCP server port) with a specific DHCP message type (likely a DHCP offer or acknowledgement, indicated by '|02|' at offset 0). It uses a thresholding mechanism to trigger an alert if 3 such packets are observed from the same source within 10 seconds, which helps to reduce false positives from single, isolated packets.