Dhcp issues / settings

Question

Dhcp issues / settings

Until 2 weeks ago dhcp worked fine using range 10.0.0.3-255, subnet mask255.0.0.0, and default gateway 10.0.0.254 and dns server 10.0.0.3 We have about 40 macs and the same no of pcs. The pcs have started showing the following settings ipaddress 192.168.1.73 eg subnet 255.255.255.0 default gateway 192.168.1.1 dhcp server 192.168.1.1 dns servers 64.86.133.51 and 63.243.173.162. The macs are unable to log onto the network for the same reason and I have had to assign a static address to the various computers to get round this problem. It happens when they have been switched off on are unable to see the network on startup.
Any ideas what is going on.
Al

G5 Quad, Mac OS X (10.4.11), System 10.4.11

Posted on May 1, 2009 4:38 AM

Reply

Answer 1

Joe Lucia

Level 1

130 points

May 1, 2009 5:03 AM in response to Alasdair MacPhee

It sounds like your edge router might have had DHCP services enabled, or some other device on your network has DHCP enabled. Can you telnet or ssh to the 192.168.1.1 after you get that address to figure out what it is?

JL

Reply

Answer 2

May 1, 2009 5:37 AM in response to Joe Lucia

I can't ping the address how do you use the telnet ssh services?
Al

Reply

Answer 3

Joe Lucia

Level 1

130 points

May 1, 2009 6:18 AM in response to Alasdair MacPhee

In Terminal: telnet 192.168.1.1 or ssh 192.168.1.1

Reply

Answer 4

May 1, 2009 6:27 AM in response to Joe Lucia

No reply using telnet or ssh, do the dns servers give any clue, as these addresses have been constant during this issue?
Al

Reply

Answer 5

Joe Lucia

Level 1

130 points

May 1, 2009 6:47 AM in response to Alasdair MacPhee

When you are connected to the 192 network go into terminal on your client and type arp 192.168.1.1 it should give you a mac address. Maybe you could cross reference this with your machines on you network, if you have this type of detailed inventory. I would check your router, firewall, and servers first to see if you have a match.

JL

Reply

Answer 6

Joe Lucia

Level 1

130 points

May 1, 2009 6:57 AM in response to Alasdair MacPhee

Doing a search on the DNS IP's shows hits about DNS changer viruses.

http://www.tek-tips.com/viewthread.cfm?qid=1538656&page=1

You might actually want to run a virus scanner on your PC's. If you don't have an up to date version, there are free scans out there.

http://housecall.trendmicro.com/

JL

Reply

Answer 7

May 1, 2009 10:03 AM in response to Joe Lucia

Do you think it something someone has downloaded onto a pc? It seems to issue an address for a certain period of time? I would need to catch when the addresses are being issued to find the mac address and get a clue as to what it is. At present it seems to be about 4 or 5 times a day.
Al

Reply

Answer 8

Joe Lucia

Level 1

130 points

May 1, 2009 12:35 PM in response to Alasdair MacPhee

If you use a managed switch you might be able to get the arp table from that and see what port is set for 192.168.1.1. Then trace it to the possible PC.

JL

Reply

Answer 9

May 3, 2009 2:57 PM in response to Joe Lucia

I have had some time to research your answers and there has been something downloaded on a machine the dns addresses are the same as the posts on other forums. I will try some of the various suggestions and let you know.
Cheers
Al

Reply