powershell script to find available dhcp scope

Additionally, he gets ongoing scope statistics so he can see track peak usage, daily averages, and trending data. The administrator gets real-time alerts when the scope reaches a pre-defined threshold.Use monitoring software such as PRTG along with a custom PowerShell script to not only alert on low addresses, but also build usage statistics over time.This can detect MITM attacks, but doesn’t provide a single pane of glass for all scopes. It does require the administrator to build a script that gathers and parses Windows event logs, though. Additionally, it provides a form of real-time alerting. If the administrator already is comfortable with PowerShell and the nuances of building scheduled tasks that run PowerShell scripts, this can be implemented fairly quickly.It may email him when it finds these events.

Write a PowerShell script (or the language of your choice) to run periodically and search the event logs for event ID’s 1020 (Low Address Warning) and 1063 (Scope Full).

This doesn’t detect MITM attacks in real time.

While this option is the easiest to implement since he only has to write some procedures for less senior staff to follow, he is now relying on a manual process prone to human error.

Perhaps he makes this a daily check for the operations team. Most administrators have the following options at their disposal: There are a number of options available for detecting when your DHCP scopes are running out of addresses however, monitoring DHCP scopes isn’t as straight forward as one might imagine. The prudent Administrator will look for ways to decrease downtime and detect security risks.

The attacker will change the default gateway and DNS address to point to his machine which causes traffic to route through his machine allowing him to sniff unencrypted traffic. He can then put a rogue DHCP server on the network and any new DHCP requests will get fulfilled by his rogue DHCP server. An attacker can create enough DHCP requests to fill the DHCP scope. After the crisis is dealt with (perhaps by lowering the lease time for addresses), he may ask himself: “How can I monitor my DHCP scopes so this never happens again?”Īdditionally, the administrator may not be aware that full DHCP scopes can allow Man-In-The-Middle attacks on his network. Any administrator that has ever dealt with a sudden deficiency of available addresses knows that this can make for a very bad day. Often, the reasoning is that they have plenty of addresses (perhaps even 3 or 4 times the amount of devices), and it should never fill up. DHCP is one of those services that many systems administrators set and forget.

Powershell script to find available dhcp scope