Default Gateway & DHCP issues - rogue server?!

[MisterTechMan]

Hi all!

 

For the last few weeks some of our windows 7 laptops appear to be getting a random default gateway. Our set up is as follows:

 

Router: x.x.12.1 (managed by our ISP)

DHCP & DNS server: x.x.12.10

 

Some clients are randomly picking up x.x.12.80 as the default gateway. Their network settings are all set to DHCP and auto. They still have internet connectivity on this address but no access to our shared drives/SIMS server.

 

There are no entries in the DNS or DHCP for this .80 address, and NSlookup does not resolve it to anything.

 

Any thoughts/ideas would be greatly appreciated!

 

Thanks

[siuko]

Try using Roguechecker

 

Should show up any other DHCP servers on your network

[Steve21]

Sounds like something is deffo on the network, you using anything like standalone wireless routers/hubs?

 

If you try to browse to the IP does it bring up a webpage etc?

 

Try a program like angry IP scanner and let it scan the network and it might bring up a better idea of what it is from the name/mac as you could see what mac it's registered to (company wise)

 

Steve

[MisterTechMan]

Try using Roguechecker

 

Should show up any other DHCP servers on your network

Thank you - brilliant idea but no luck i'm afraid.

 

 

 

 

Sounds like something is deffo on the network, you using anything like standalone wireless routers/hubs?

 

If you try to browse to the IP does it bring up a webpage etc?

 

Try a program like angry IP scanner and let it scan the network and it might bring up a better idea of what it is from the name/mac as you could see what mac it's registered to (company wise)

 

Steve

 

Thank you Steve - solved our issue. The scanner found the IP and it turns out this is the router for our phone PBX. Our support company installed and manages this so i'm wondering if they have made any changes without informing us!

 

Thanks guys.

[DSapseid]

I had this exact same issue about 3 weeks ago. Was the router for my phone system as well! Spoke to my phone support company and they hadnt touched it, i trust them as well as worked with them for 12+ years and only 3 guys in the support team. I logged onto the router, turned off dhcp and all was well on my network. Never did work out what had happened to it!!

 

Mine is a Draytek router, yours the same?

[yac2016]

I had this exact same issue about 3 weeks ago. Was the router for my phone system as well! Spoke to my phone support company and they hadnt touched it, i trust them as well as worked with them for 12+ years and only 3 guys in the support team. I logged onto the router, turned off dhcp and all was well on my network. Never did work out what had happened to it!!

 

Mine is a Draytek router, yours the same?

 

Yep it's an issue with Draytek routers. Update the firmware asap.

[MisterTechMan]

I had this exact same issue about 3 weeks ago. Was the router for my phone system as well! Spoke to my phone support company and they hadnt touched it, i trust them as well as worked with them for 12+ years and only 3 guys in the support team. I logged onto the router, turned off dhcp and all was well on my network. Never did work out what had happened to it!!

 

Mine is a Draytek router, yours the same?

 

DrayTek indeed!

 

Yep it's an issue with Draytek routers. Update the firmware asap.

 

I think I remember seeing a thread about a recent issue/vulnerability with DrayTek routers... a quick google news search for "Draytek vulnerability" shows many recent articles with more details.

[Davit2005]

We had this similar issue a few months back, this is I found the device

 

When you are experiencing the issue,

1) Go to a client that has being given an IP address by rogue DHCP.

2) Ping the default gateway that the client has being given

3) Open cmd and run arp -a , this will give you MAC address from the IP address.

4) Go on to your switches and find where the MAC address is plugged in

5) Locate device, deal with device and deal with user/owner .

 

It was being caused by a Media streaming device that if it does not recieve an IP address it starts acting like a DHCP server. We use an IPAM solution here which means that majority of end devices do not get IP address automatically. The user did not know what the big fuss was about when we tried to explain the issues this caused and would cause.

Edited June 7, 2018 by Davit2005

[MisterTechMan]

We had this similar issue a few months back, this is I found the device

 

When you are experiencing the issue,

1) Go to a client that has being given an IP address by rogue DHCP.

2) Ping the default gateway that the client has being given

3) Open cmd and run arp -a , this will give you MAC address from the IP address.

4) Go on to your switches and find where the MAC address is plugged in

5) Locate device, deal with device and deal with user/owner .

 

It was being caused by a Media streaming device that if it does not recieve an IP address it starts acting like a DHCP server. We use an IPAM solution here which means that majority of end devices do not get IP address automatically. The user did not know what the big fuss was about when we tried to explain the issues this caused and would cause.

 

That makes sense - and will definitely come in handy in the future!

 

Many thanks

Edited June 7, 2018 by MisterTechMan

[DanTheLacky]

The user did not know what the big fuss was about when we tried to explain the issues this caused and would cause.

 

Your just being an unreasonable IT worker! I bet you are the same guy that gets annoyed when they start trying to bypass the filtering etc

[Davit2005]

Your just being an unreasonable IT worker! I bet you are the same guy that gets annoyed when they start trying to bypass the filtering etc

 

, yep nowt better to do .