Friday, October 23, 2020

Has anyone seen this before? Could a consumer device hoard all of the IPs in the subnet?

I had a network today that ran out of DHCP addresses because the scope filled up with BAD_ADDRESS because it detected a conflict. I cleared some of them, and the real devices were able to successfully get a lease. I took over this customer a couple months ago, and immediately migrated their DHCP server from their ASA firewall to their Windows server a couple months ago because they've been having intermittent issues with IP Conflicts for at least over a year, and wanted a bit more control and logging that I'm good with. At first I thought it was because they just had a computer or two static'd within the DHCP range, but today something must have been responding to pings to all IP's on the subnet, right? Maybe this has been their problem the entire time. The ARP table on the firewall, since it's a DHCP relay for this network, shows entries for all of these BAD_ADDRESS IP's were a MAC address registered to Netgear. I haven't visited in person yet, but I'm thinking it could be like a repeater or something, since this is a wireless network. Anyone seen anything like this before?



No comments:

Post a Comment