<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Detecting DHCP Attacks — API & Tool Reference

> Quick reference for tools, commands, and APIs used in detecting-dhcp-attacks.

## Tools


### `nmap`

DHCP discovery via NSE scripts

**Usage:**
```bash
nmap --script broadcast-dhcp-discover -e <iface>
```

**Key Flags:**
  - `--script: NSE script`
  - `-e: interface`
  - `broadcast-dhcp-discover: find DHCP servers`

---

### `dhcpd-pools`

DHCP pool utilization reporter

**Usage:**
```bash
dhcpd-pools -c <config> -l <leases>
```

**Key Flags:**
  - `-c: dhcpd.conf path`
  - `-l: leases file`
  - `-f j: JSON output`

---

### `tshark`

CLI Wireshark for DHCP analysis

**Usage:**
```bash
tshark -r <pcap> -Y 'dhcp'
```

**Key Flags:**
  - `-Y: display filter`
  - `-T fields: field extraction`
  - `-e dhcp.option.dhcp: message type`

---


## Integration Notes

- All tools should be run with least-privilege access appropriate to the task
- Log all tool invocations for audit trail
- Validate tool output before acting on results
- Cross-reference findings with multiple tools where possible

## See Also

- Parent skill: [Network Security](../../../SKILL.md)
- Technique SKILL.md: [../SKILL.md](../SKILL.md)
