dhcp & dns issue

[rh71]

Issue:

DHCP servers which are also the DNS servers randomly gives out the incorrect dns ip (192.168.1.1) to random users instead of the correct dns ip's. When that happens, users can't connect to the internet. It does that even before the dhcp lease expires. In a space of a few minutes, it would have the correct dns ip and a few minutes later it will give out the wrong ip. Have two dhcp servers and both of them are experiencing the same issue.

The day prior, users were also having file server slowness issues. This has resolved itself now.

Rebooted both dhcp servers which hasn't helped. Checked the dhcp scopes and the dns ip's are both correct. Ipconfig /all shows the correct dhcp ip but incorrect dns ip on those pc's affected. Pinged the incorrect dns ip but ping times out. What could be the cause of the problem?

 

[Genx87]

Rogue DHCP server?

 

[mxnerd]

See if there is other DHCP server on the same network.

DHCP explorer.

http://www.networksecurityhome.com/network_tools/dhcp_discovery/dhcp_discovery.html

Also please describe your source of DHCP & DNS servers. Windows, Linux or router?

=========

I misread the post. You are actually running 2 DHCP servers at the same time. It will create IP conflicts. You should have only one DHCP server running.

 

[rh71]

Thanks - we think we did find a rogue dhcp server - have the mac address by doing arp -a. Next problem is how to locate it. We were told about DHCP Snooping to prevent issues like this. Wondering if we could employ that now and just cut it out instead of having to physically find it. We do not have managed switches however.

 

[JackMDS]

It can happen when someone who is Not Network savvy plugs a Wireless Router with its DHCP on somewhere on the Network to create his own Wireless Hotspot.

You can put this free portable App on a Wireless laptop and look for the SSIDs to find such a source (if it is indeed there).

http://www.majorgeeks.com/files/details/wifiinfoview.html

 

[blackangst1]

It can happen when someone who is Not Network savvy plugs a Wireless Router with its DHCP on somewhere on the Network to create his own Wireless Hotspot.

You can put this free portable App on a Wireless laptop and look for the SSIDs to find such a source (if it is indeed there).

http://www.majorgeeks.com/files/details/wifiinfoview.html

Bingo. We get this alot in our environment.

 

[mxnerd]

Better find who accidentally or intentionally placed the DHCP server on the net and give the person or all users a warning because it disrupted the integrity of the net.

Leave it on the net is no good.

 

[imort]

Issue:

DHCP servers which are also the DNS servers randomly gives out the incorrect dns ip (192.168.1.1) to random users instead of the correct dns ip's. When that happens, users can't connect to the internet.

Looks like a 'rogue DHCP server'.

You need to setup one of the software available to check if there any other DHCP servers in your network which can send DHCP offers too along with your DHCP servers.

So if your client received such a offer it will receive the incorrect IP lease and you have that problem you described above.

Looking at your DNS server address (192.168.1.1) I can tell that it looks exactly like some default gateway for many devices.

Maybe someone is connect it's own modem, router or access point to your network.