Detect rouge DHPC server

I could not get connected to my Billion 7800GZ router but I have found following entries in syslog:

Jul 25 09:51:18 192.168.1.254 DHCP SERVER: DHCPINFORM from 192.168.1.126
Jul 25 09:51:19 192.168.1.254 DHCP SERVER: DHCPINFORM from 192.168.1.111
Jul 25 09:52:51 192.168.1.254 DHCP SERVER: DHCPDISCOVER from 8c:70:5a:66:2e:a4 via br0
Jul 25 09:52:52 192.168.1.254 DHCP SERVER: DHCP offer to 8c:70:5a:66:2e:a4
Jul 25 09:52:52 192.168.1.254 DHCP SERVER: Exiting as another DHCP server is found
Jul 25 09:57:48 192.168.1.254 syslog: web: logout (timeout)
Jul 25 09:57:51 192.168.1.254 syslog: web: 192.168.1.250 login
Jul 25 10:18:53 192.168.1.254 home -- MARK --
Jul 25 11:18:53 192.168.1.254 home -- MARK --
Jul 25 11:48:17 192.168.1.254 syslog: web: logout (timeout)
Jul 25 11:48:19 192.168.1.254 syslog: web: 192.168.1.250 login

Then I have rebooted the router to restart dhpc server. It start working as it should. The router was up for 9 days. Therefore I have started looking for a way to detect rouge DHCP server.

Step 1. Nmap scanning

• Billion router scanned with NMAP when DHCP was ON:

Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-25 12:24 BST
Nmap scan report for home.gateway.home.gateway (192.168.1.254)
Host is up (0.00042s latency).
PORT   STATE         SERVICE
67/udp open|filtered dhcps
68/udp closed        dhcpc
MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)

• Then DHCP server disabled with command

> lan config --dhcpserver disable

• The router has been rescanned

Nmap done: 1 IP address (1 host up) scanned in 1.40 seconds
$ sudo nmap -sU 192.168.1.254 -p 67-68
Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-25 12:25 BST
Nmap scan report for home.gateway.home.gateway (192.168.1.254)
Host is up (0.00036s latency).
PORT   STATE         SERVICE
67/udp open|filtered dhcps
68/udp closed        dhcpc
MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)

Nmap done: 1 IP address (1 host up) scanned in 1.43 seconds
$ sudo nmap -sU 192.168.1.254 -p 67-68
Starting Nmap 6.00 ( http://nmap.org ) at 2013-07-25 12:25 BST
Nmap scan report for home.gateway.home.gateway (192.168.1.254)
Host is up (0.00040s latency).
PORT   STATE         SERVICE
67/udp open|filtered dhcps
68/udp closed        dhcpc
MAC Address: 00:04:ED:B1:7F:AC (Billion Electric Co.)

• Billion router busybox interface

> lan       

Usage: lan config [--ipaddr <primary|secondary> <IP address> <subnet mask>]
                  [--dhcpserver <enable|disable>]
       lan delete --ipaddr <primary|secondary>
       lan show [<primary|secondary>]
       lan --help
> lan config --dhcpserver enable