Finding a Rogue DHCP Server

[atray]

I am running a Cisco based network with many linux boxes.

Somewhere in the mix I have a DHCP server that is serving out improper addresses. I was wondering if anyone knew of a way that with management tools i could locate the address from which they originate on the Cisco stack so I could locate the machine.

Any help would be welcome.

Thanks,

[GusL]

Try doing an nmap UDP scan and look for port 67 open. That is the standard UDP DHCP port. Or you can do a "ps -A" on all your boxes and see if there's a service named something like "DHCPd"