Weird problem: I can ping, but can not physically find a router !

[budgester]

But the DHCP server would have a list of host names, anything stand out ?

[twin--turbo]

Also on the rouge device web console, what is the product name so you can look at what it looks like.

 

Rob

[emboha]

The name is SKYNET_BE, and it is not on my server's dhcp list, not by that name, and not by that mac adress.

I'll walk around the building tomorrow with the wifi analyser tool and search for that SSID. I'll keep u guys posted, thx for all the help allready ;-)

[spadam]

I'll keep u guys posted

 

Well.. did you find it already?? It's been a week - I'm ready for the next chapter...

[pantscat]

What sort of switches have you got?

Most will let you do a "Show mac-address 11:22:33:44:55" type command and show you which port it's connected to... makes life a LOT easier.

[emboha]

the problem returned today, i again changed the password and the settings... solved again, but for how long?

 

my switch:

• DGS-1500-28: 28-Port Gigabit SmartPro Switch including 4 SFP ports (fanless) from DLINK
  

Can i get the info with that switch even if the device isnt directly connected to it but through a couple of other regular switches?

[pantscat]

Yep - should tell you which port it sees the mac address on, even if that port links to another switch...

[emboha]

Today I used my manageable switch to add the ip of a trusted dhcp server (my win2012 server) and blocked all the ports on my switch (except the one(s) of my server) to allow dhcp.

 

I hope this helps, we wil see...

[emboha]

Ok, this seems to have fixed the problem permanently. In my manageable switch at the beginning of my network i adjusted the following settings:

 

Security/DHCP Server Trusted Port Settings: all disabled except the 2 ports which are used for the server.

Security/Trusted DHCP Server IP Settings: added the internal IP-adress of my dhcp server (win2012 standard machine)

 

No rogue dhcp server should be able to be active on my network anymore now...

Still find it odd tho, that U have to block such a thing...

[synaesthesia]

Sorry, this isn't entirely related.

Topic just reminds me of this (one for the older geeks!)

 

QDB: Quote #5273

[twin--turbo]

No rogue dhcp server should be able to be active on my network anymore now...

Still find it odd tho, that U have to block such a thing...

 

It's not fixed the problem, only hidden it.

 

Rob

[emboha]

not completely sure what u mean by that, Rob

No laptops get weird IP-adresses anymore now, so it seems to me the problem is indeed fixed? U mean that the rogue machine is still on my network somewhere? Can be, but i seems it isn't able anymore to act as a dhcp server...?

[edutech4schools]

heh, i got into the admin console with some other standard password. Changed the admin password and messed up the settings up(disabled dhcp etc) (I know, I'm evil ;-) ) so now the laptops are connecting fine.

He can always hard reset the thing, but since it was standard password protected, i don't think he knows a lot about these kind of things...

 

When the problem occurs again, i'll have a lookout for some rogue AP's in the building with my smartphone.

 

I would so laugh if it turns out one of the schools neighbouring houses has an open wireless unit and the school laptops are jumping on to that and you have just changed the password on it.

[twin--turbo]

If it was there, and you have not removed it then it's still a potential issue. And why is it there, who has put it there and will they do it again. Blocking the ports on the switch will not prevent it from handing out wi-fi DHCP if that becomes active again.

 

Rob