DHCP conflicts from somewhere

[cromertech]

It appears that I have a second DCHP server dishing out IP addresses on my network. I think it must be a wireless router of some sort as the addresses I'm getting are in the 192.168.1.0/254 range.

Is there any way i can trace the offending object with software in as much as work out what switch it is connected to as a search of the school has not provided any such devices.

I know of one such router that we have that supplies the network admin staff with internet in order to bypass the filtering but this has been working quite happily for over a year now (and i've tried with it off and get the same results) and the problems have started in the past week.

Failing tracing the device is it possible to get my domain machines to only look for DHCP leases from one server?

[p858snake]

although i do know there is a technical around, but could you discount each sub switch from your master switch and see which one still gets DHCP?


What about "The Dude" or try logging into 192.168.1.1 or whatever gateway is giving and trying to disable it?

[IrritableTech]

Find a machine that has got a 192.168.0.x address, and do an ipconfig /all. You should then have the address of the dhcp server (I'd bet 192.168.0.1 or 192.168.0.254) then open that address in a browser, It is most likely to give you a name of the device, which will help you find the culprit.

If you can log in to the AP/router or whatever, you'll be able turn off the dhcp service without leaving your seat.

[cromertech]

Thanks. Got a scan going now in "the Dude". hopefully this will show something

@terrorvis. I tried to do that but got a web page not found error. I'm wondering whether it maybe a student running a DHCP server on a laptop just to p*** me off. Some of our kids are just too clever for their own good

[mac_shinobi]

I normally use Lan View

LANView is a powerful tool for LAN administration

[bossman]

@cromertech:

I would suspect it is a rogue laptop especially as you cannot browse to it.

Good luck with it.

[DAZZD88]

I'd assume u haven't accidentally forgotten about any wireless access points that you may have installed somewhere. We did this once, wondered why bad crack was happening.

99% of the time it is a rogue AP dishing out ip addresses either because of a firmware issue or because it's incorrectly configured.

[p858snake]

since you can't access the webpage did you try going "\\IP\c$\"

also I seem to remember if you tracert a device that goes though multiple switches it will show you but i can't test that so I don't know if its just random idea or the truth"

[bossman]

@cromertech:

try "NBTSTAT -a 192.168.100.7" I don't remember if the -a has to be
upper or lower case, so try both.

[mattx]

@cromertech:

try "NBTSTAT -a 192.168.100.7" I don't remember if the -a has to be
upper or lower case, so try both.

-a name
-A IP address

[mpe]

It appears that I have a second DCHP server dishing out IP addresses on my network. I think it must be a wireless router of some sort as the addresses I'm getting are in the 192.168.1.0/254 range.

Is there any way i can trace the offending object with software in as much as work out what switch it is connected to as a search of the school has not provided any such devices.

A network protocol analyser, such as wireshark, will tell you where these are coming from.