It looks like you're using an Ad Blocker.

Please white-list or disable AboveTopSecret.com in your ad-blocking tool.

Thank you.

 

Some features of ATS will be disabled while you continue to use an ad-blocker.

 

Help find the culprit that ruins the network? (Resolved)

page: 1
1

log in

join
share:

posted on Jul, 29 2015 @ 04:42 AM
link   
I'll try to keep it as short as possible.

We've recently removed our proxy server (and gateway) from the network that used to provide Internet access to the entire network on IP address 192.168.0.254.
The new gateway is on address 192.168.0.245. (The people that installed the new gateway - a Mikrotik router - initially used the IP 192.168.0.254 as well, which needless to say caused chaos on my network.)

Everything is working great again, except whenever I add a new device to the network it automatically picks up 192.168.0.254 as the default gateway. Meaning I have to manually set the default gateway - which is easy enough, but shouldn't be necessary and is causing problems with "dumb devices".
The old proxy server that was on that address is completely removed from the network.
I've asked the people to check their equipment (router) and make sure there is no traces left of the 192.168.0.254. There is not - according to them.
The DCHP server has 192.168.0.245 as default gateway.
Pinging the address 192.168.0.254 shows that there is no such device on the network.
I've run several network sniffers, and none of them pick up any trace of a 192.168.0.254 device.
There are no intelligent/managed switches on the network. Only the Mikrotik router which I don't have admin rights for and a WiFi router but I've checked that as well.

TLDR: Something on my network is broadcasting 192.168.0.254 as the default gateway. How do I find who/what is doing the broadcasting?
edit on 29/7/2015 by Gemwolf because: (no reason given)



posted on Jul, 29 2015 @ 04:54 AM
link   
a reply to: Gemwolf

You need to be looking at the DHCP scope of whatever device is the DHCP server.
If you do an ipconfig /all and then check what it says is the DHCP server IP is and then check the config on that device.



posted on Jul, 29 2015 @ 04:54 AM
link   
Even though the IP gateway of the DHCP server has been set correctly, it may need to be updated in the DHCP scope section of the device.

Changing the default gateway on the NIC on a Windows Server will not update the DHCP server. You would need to go into the DHCP scope and change it in there.
edit on 29-7-2015 by mclarenmp4 because: (no reason given)



posted on Jul, 29 2015 @ 04:59 AM
link   
a reply to: Gemwolf

I would use the ipconfig command to see a list of everything connected:
Bring up a command prompt and enter 'ipconfig /all'.
Example:
C:> ipconfig /all

More info here ss64.com...



posted on Jul, 29 2015 @ 05:23 AM
link   
Thanks for the help guys! Much appreciated!!


originally posted by: mclarenmp4
...
Changing the default gateway on the NIC on a Windows Server will not update the DHCP server. You would need to go into the DHCP scope and change it in there.


Bingo! I think we've found a winner. Checked the DHCP scope, and there hidden in the Scope Options was defined a Router on 192.168.0.254.
I changed it and will report back what I see.

Thanks a million!



posted on Jul, 29 2015 @ 05:27 AM
link   
a reply to: Gemwolf

Not a problem, glad i could help.



posted on Jul, 29 2015 @ 06:01 AM
link   
I ran a couple of test, and it looks like that resolved the issue. Thanks again.



posted on Jul, 29 2015 @ 11:35 AM
link   
Perhaps your web server, or one of your web servers or servlets, is still pointing to the old address?
a reply to: Gemwolf



new topics

top topics



 
1

log in

join