DHCP Range

When a DHCP server is active in the network monitored by a network interface, it’s advisable to configure in ntopng the ranges of IP addresses which such server can assign.

When a DHCP range is configured, ntopng will monitor the DHCP traffic on the interface and report anomalous behaviours. For example, it detects if IP addresses are assigned outside the configured range and generate an alert. This can happen, for example, if a new misconfigured network device is attached to the network.

Since DHCP responses are usually directed to a specific host, this setting is most effective when the interface monitors mirrored traffic.