Strange MAC address in DHCP table????

The only printers on the network are hooked up through Printer ports directly on the internal machines and are shared.....There are no network printers with an IP or MAC address on the network

Shawn_H

If you are double DHCPing, you will get a ghost from the inter-DHCP change in C-address.  Only one router should DHCP, not two.  Set the wireless as transparent and put everything on the same class C.  Much more reliable.

Okay, its 1:30 am now, Ill try that tomorrow night when I get home from work, but I didnt think it would matter if both were set up to DHCP as long as both were on different Class C networks, which they are, they Dlink is set up to only allocate to its internal network, not off of the WAN port. The reason I had it set up like that in the first place is a long story, but Ill try to give a shor version here:

I originally bought the Dlink before I got the DSL service, in anticpation of the DSL service I was waiting on. The Dlink does not have a built in Modem, its only Router/Switch/Access point. Well when I finally got the DSL sevice I found out that all our carrier supports in this area is PPPoA and not the more common PPPoE in the US. So then I had to track down a modem that supports PPPoA and found the Zoom router. so I tried hooking the cable from the internal zoom port, to one of the 4 switch ports on the DLINk and just using the Dlink as a switch/ Access Point. Well that didnt work, it was like the Dlink didnt want to work if its WAN port wasnt plugged into. So thats when I told the zoom to act as DHCP server, and told the WAN port on the Dlink router to retrieve its IP dynamically(fooling it into thinking its getting it from the ISP), and let the DLINK do its router thing to the and from the internal network (route to the zoom which routes to the ISP).

Also, if its getting a ghost MAC address from the other DHCP server (the zoom) where would it be comming from, that myterious MAC address doesnt match any MAC address on either one of the routers, of on any machine inside the DLINKs LAN port.

Thanks

Shawn_H

Oh yeah, I shouldve mentined that the default class C subnet is being used on both networks with the private addresses 255.255.255.0 and I know that DHCP cant natively traverse routers and subnets without some kind of bridging software being used, if Im correct.

Shawn_H

Still don't see why you need the two class Cs.  Why not let the 192.168.5.x domain pass right through the Dlink and reflect into the systems, so they are getting their IPs from this Zoom DHCP, with DHCP off on the Dlink?  Why will this not work.  There is nothing wrong with having the Dlink think its WAN is coming from the zoom, but since the zoom is the ultimate gateway for the internet, the PCs should be able to see through the Dlink to that primary source.  Dual DHCPing generally gives problems, unless they are on 2 separate networks.  Yes you have 2 separate class Cs here, I see that, so it is technically feasible.  Maybe if there is no problem, leave it alone.  The ghost could be the virtual WAN that the Dlink is picking up as a reflection of the Zoom's translated wan.  Or another option, since the Dlink is wireless, you might have a neighbour accidentally sharing your internet connection without realized he/she is.  Those wirelesses love to give access to anyone and everyone in the neighbourhood, you know.

LOL sciwriter, yes those wirelesses do love to hand it out, but I thought this shoulve been taken care of by using a 128 bit Hex key WEP and by NOT broadcasting my SSID

As for letting the Zoom DHCP pass through the Dlink, I would have to disable routing on the DLINK, would'nt I? I tried doing that, but couldnt figure out a way. As I mentioned, I unplugged from the wan port, and plugged the zoom into one of the 4 switch ports, then plugged a system into a switch port on the DLink. I couldnt get an address from the Zoom. Keep in mind, the zoom only has 1 ethernet port on it for the internal LAN, so I thought that by plugging it into a LAN port on the DLINK it would send DHCP through to the other machines. BUT, It just seemed like the DLINK did not want to give up its routing functionality, and is dead set on routing From LAN ports to the WAN Ports. DLink has an emulator for this device on their web site if you would like to take a look at configuaration options for it.

http://support.dlink.com/techtool/di624_revc/emulator/h_wizard.html

Thanks

Shawn_H

Hi,

I think that you even if you don't see it coming the two DHCPs are needed as the experts said. They have the tendency to confuse packets and PCS in general, to he point to generating a mysterious MAC? i doubt it....
If i were you i would disconnect my DLINK wireless, clear the arp cache and display your MAC table...I doubt you will see it.
Second step connect the DLINK wireless ALONE, if you still see it .
Reset your wireless to factory default, enable 128 encryption, Register teh MAC add of the laptops and see what happens...
Other thing, I found some saying that it is virtual adapter MAC, do u have an kind of device like a 1394 device.....
Hope this helps.
 

Well Shawn, the normal way would be to go into the Dlink setup first, and turn off DHCP on it.  Reboot it, plug the single LAN of the Zoom into the LAN (not WAN) of the Dlink, and then the other computers into the other LAN ports.  

The Dlink is just acting now as a hub repeater -- the WAN function is not active, because the Zoom is doing the translation from WAN to LAN, as well as DHCP.  That is how you make the Dlink transparent.

I'm not trying to frig your setup here, I think you did well to get the Zoom working, and the Dlink as a sort of an IP bridge, and if you are happy with that, stick with it !!!

sciwriter my friend, I know that your not knocking my setup...dont worry, I dont take it like that either. Your help and your suggestens are greatly appreciated.

Its just that the setup that you are suggesting is the one that I originally tried (as mentioned in threads above), turning off DLink DHCP, unplugging from its Wan Port, and plugging all into the switch ports, and restarting the Dlink Router. However, now you have me doubting whether or not I missed a step, so later tonight, when all go to bed, Im going to try it again We live on the net here :-) Thats the way I wanted it setup origianally, I dont like having the extra hop in there. I let you know later this evening how it turns out.

I do have a little more info for you though about the Mysterious MAC, let me know what you think about this. Enter this search term into Google:

E9-EB-B3-A6-DB-3C + MAC Address

and youll be linked to a message board on dslreports.com

These guys experienced the exact same MAC address in there DHCP table, and most did not even have wireless on thier network. Well I just remembered earlier that about 3 weeks ago I had dslreports.com test my dsl line, transfer rates etc... I also had them do a port scan to tell me what was opened.   hhhhhhhhmmmmm starting to sound mighty suspicous, Im just guessing here, but woudlnt doubt if these same guys on this message board from dslreports had the same things done from dslreports.  But what I dont understand is how they come all the way in to the Dlink router because thats where the MAC is. Anyway, Im going to give the Network another shot latter tonight, trying to put the DLink in the role of switch / access point only. I'll let you know how it goes.

Once again, thanks for your help

Shawn

Actually, Shawn, the first thing I thought of was a hack attack -- but if you have scanned all your systems for worms, and there is nothing, it is unlikely that the MAC address -- detective -- is in fact a worm.  If it is a backdoor to DSL reports, they are no better than a worm, right?  SO because I couldn't come up with an answer, I didn't comment on it.

However, when you are in your routers tonight, go through EVERY tab they have, just to make sure there is no reflector setting, or a debug setting.  If you can find nothing to create that extra MAC, it is either an outside accidental connection, an artifact of the Dlink bridging the two class C domains, or else perhaps the equivalent of a looback adapter.  Also, it could be created by MS networking, perhaps an unusual setting in the TCP/IP or something like that?

The key to making the DLink transparent is to make sure you totally reboot everything -- even both routers, in sequence, and only later start the computers.  Windows has an idiotic way of being slow to pick up on new settings, and far too slow to forget the old outdated ones.  ALL systems need to be off, otherwise, they will hang on to ghosts.  So as soon as the routers reboot, shut off all systems.  then reboot them.  You might have to go through the DLink fairly carefully to make sure it will see the Zoom as the WAN gateway, and turn DHCP off, but it SHOULD work.

Good luck

OK NOW ITS GETTING WIERD! The MAC address is gone from the table, BUT I couldnt shutdown or restart my machine,Pulled up Nortons and my Email Scan and Auto protect has been turned off and I can not turn them back on. I ran Live update and than ran a full sys scan but Nortons returned nothing. Ive been going through my processes, but cant seem to find anything out of the ordinary. Thinks I's been hacked and had a worm laid upon me! Any suggestions?

point value has just been increased......The saga continues

Shawn

go to this --www.trendmicro.com -- download the VXD and run their on-line virus scanner.  

You need to tell me what OS you are running, because my first suspicion of a worm seems most likely, but need to know the OS and the File System, FAT32 or NTFS -- if NTFS, it will be a lot harder to fix, of course.

Ah yes, my good friend sciwriter, I am running WinXP Pro with NTFS, I have several partitions on the disk. 4 to be exact. I am almost postive it is something backdoor, becsause when rebooting and disconnecting from the network I did not have the problem. I'll run the scanner now.

Shawn

PS.... I had to do a hard shut down to get the machine down

I have ad-aware, spybot and cwshredder, and run them often. I ran the online scan, but nothing came up Heading of to bed now, have to work tomorrow, but will keep you posted...I appreciate the help.

Ill run fixboot tomorrow

Well sciwriter, I tried re-doing the routers last night and ran into the same problem that I had during the initial set up. I disabled the DHCP server on the Dlink, and unplugged the WAN port and tried using the DLink as switch and AP only, I then shut everthing down, plugged the Zoom a Dlink Lan port, and brought everything back up. The LAN machines could not get an assigned address from the zoom. However, I was on one Class C subnet at this point and set my static IP to this subnet and could ping, surf etc... to the outside world :-) But, becuase I need my DHCP, (laptop goes to work everyday) I went ahead and changed it back.  ITs like the Dlink wont let the DHCP pass through, I had its firewall disabled too.

Anyway....

I also found a backweb.exe running in my process list last night.  I think its from that stinken Logitech mouse and Keyboard I bought. You think that would be malicious enough to have Norton's Email and auto protect disabled and non functional. regarless, I want rid of it, even if it means removing that software.  Also, when I rebooted that machine and came back up on the network, everything seemed to be working fine....for now.

Shawn

Strange there is no pass through -- did you try giving the Dlink a dynamic IP -- that would lmost certainly fix the pass through issue.  Some need static, some dynamic.  Well at least you know your system is clean now, and yes, get rid of the special mouse drivers -- if they can't work with an XP driver, try something else.  As for leaving the laptop as dynamic IP, you should always do this -- I think maybe the Dlink needed one too, but don't go redoing it again, just for that.  It could be a bug in the Dlink firmware -- perhaps a re-flash would fix?  I had to flash my Dlink, because it was always crapping out on the WAN connection.  If you flash it's BIOS, make sure you do it with a HARD cable !!!

Hope everything helped.  Have to go now, get back to work, am leaving EE.  Best of luck.

Thanks for the help sciwriter, everything seems to be working, I appreciate the your time and help

Shawn

Shawn, I dunno if you're still monitoring this thread or not...but I'm having the exact same problem. Question for you: do you have a box running Windows Server 2003 on your network, and if so, is it acting as a Domain Controller or part of a domain?? Further if you don't have a domain, then do you have DNS service installed on there?? I have a DLink DI-524 router, and am getting the same MAC address....it only started appearing after I installed this Win2003 box...

I have the same thing - odd mac addresses with hostname of detective, as soon as I installed a Win 2003 server

Actually scott110, I did have a verison of Window server 2003 setup as a domain controller at the time....Interesting. Sorry I didnt catch your post when you listed it. I just saw it now with rattymon's post.

Thanks

I had the same 'detective' DHCP client show up as well, immediately after installing MS 2003 Small Business Server on my home network.  I found it listed with the DHCP clients in my IPCop DHCP log and Google led me here.  For the record I had 3 MACs for detective, the E9-EB-B3-A6-DB-3C one and also 4d:c8:43:bb:8b:a6 and 32:f6:9e:7d:49:dc.  Interesting indeed..