Odd IP's in DNS

[russlp]

I've noticed we have a few odd entries in our DNS for some of our AD joined teacher laptops. 

These only seem to appear for devices on our staff vlan. 

 

I've checked for rogue DHCP, turned off our DHCP (no ip is offered) but random clients seem to get these odd IPs rather than the 10.45.X.X ones they should be getting.

 

Any ideas what else could cause this?

 

Thanks

[5tu]

Can these devices connect into your network via VPN?

[russlp]

Yes they can - We use softether vpn - we have a rule that stops them connecting via the vpn when in school - and the vpn server only offers IP's on the same vlan e.g 10.45.X.X as well. 

[5tu]

Do you have any DHCP services running on any VLANS using the 192.168.x.x subnet?  BYOD?

[robintech]

does "Get-DnsClient" show an interface that you don't expect to be registering an address, then you can look that up to narrow it down.

[russlp]

Nothing nope, only our 2 DC's. The only thing we have on 192.168.100.X are our unifi switches and they are set to relay DHCP to our DC's. DHCP guarding is also on. 

 

I've ran some tools to look for rogue DHCP and haven't found anything and Wireshark doesn't show anything other than our 2 DC's -  I've not managed to pry an affected device off a teacher yet. They are laptops that have a wired and wireless nic so not sure if it's something to do with that or not... 

[russlp]

Got to the bottom of this today - our clevertouch TV's were sharing their network connection via USB which was being added as an additional nic - we turned off the setting: "Allow the IFP to share network with USB connected device" on the android settings and the issue has gone.

 

Happy Friday!

Edited November 14, 2025 by russlp