[Webinar] Learn how to a build a cloud-first strategyRegister Now


Invisible DHCP server on Linksys router?

Posted on 2004-11-18
Medium Priority
Last Modified: 2013-11-29
I have set up a home network using a cable modem and a Linksys WRT54G with computer on both the wired and wireless side.  I had DHCP enabled on the router using network, mask, and starting with IP address  Everything was working fine until all the computers renewed their address yesterday.  The computers are now being assigned sequential IP address, starting in the 20's.  An excerpt from "ipconfig /all" follows.

Ethernet adapter Wireless Network Connection:

        Connection-specific DNS Suffix  . :
        Description . . . . . . . . . . . : Dell Wireless WLAN 1450 Dual Band WLAN Mini-PCI Card
        Physical Address. . . . . . . . . : 00-11-F5-05-3A-25
        Dhcp Enabled. . . . . . . . . . . : Yes
        Autoconfiguration Enabled . . . . : Yes
        IP Address. . . . . . . . . . . . :
        Subnet Mask . . . . . . . . . . . :
        Default Gateway . . . . . . . . . :
        DHCP Server . . . . . . . . . . . :
        Lease Obtained. . . . . . . . . . : Wednesday, November 17, 2004 4:32:20 PM
        Lease Expires . . . . . . . . . . : Monday, January 18, 2038 9:14:07 PM

The default gateway is correct, but there are no DNS entries, so the computers effectively access the web.  Also, it says the address was assigned by, but there is no computer there.  If i assign a static IP to a computer and tell it to go to the router for DNS lookup, it work fine.  My first thought was that one of the computers may have been operating as a DHCP server through ICS.  After checking all the computers, none of them had ICS running and all had the same problems with their IP addresses.  I turned off all the other computers on the network and verified that I still had the error, then I turned off this computer and verified the error on one of the previously off computers.  I believe I have now ruled out all the computers on the network leaving only the router as the source of the error.  I upgraded the routers firmware, from v2 to v3, and performed a factory default reset.  Alas, the problem persists.  I have a CCNA certification and manage a small Cisco 800 network at work, but this dilemma is making a fool out of me.  Thank you for your assistance.
Question by:adambutt
LVL 79

Expert Comment

ID: 12620184
There has got to be something at that is handing out IP addresses. Suggest putting a sniffer on the network to trap th mac address of this rogue DHCP server.
Have you tried disabling the DHSP server on the Linksys and see if you still get an IP?
Does someone have another linksys/soho router under their desk that they are using as a small switch?

Author Comment

ID: 12620303
I have tried turning off DHCP on the router, and the problem does not go away.  There are no other routers on the network, and all other computers have been turned off.  I tried running ethereal, but it can't see any of my interfaces.

Expert Comment

ID: 12620390
After the factory reset you had to go back and configure the WRT54G as before, right?
Do you still have the problem if you use a different setup for the router?

Disable all wireless access and settings on the router and check the LAN machines again.
Unplug all LAN connections, enable wireless and try your wireless clients.

Is it possible the wireless network has been compromised?

Accepted Solution

JohnCarlMorgan earned 1000 total points
ID: 12620393
Assuming your router is then it is not the problem.

As lrmoore said another host on your network ( is running a DHCP service in some form or other.  If you are fairly sure that there are no other devices turned on, on your network then ping it & if it replies then quite obviously you are mistaken.

You can suss out the host a bit - try the following.
 - nbtstat -a (if it is a microsoft host this will tell you the computername & who is logged on)
 - try accessing  If it is another soho router sitting under someone's desk it may have some webadmin listening on port 80.

Tou could PING -t.  You will most likely get replies.  have someone watch the replies whilst ripping each network point out of the patch panel 1 at a time until it times out.  This will make it quite obvious which port it was on the panel's side.  Got a tracer?

Author Comment

ID: 12620853
No ping responce.  As I was following all the cat cables to unplug them from the computers, I found a paralell port print server that had been disconnected from the printer and fallen behind a desk.  It was disconnected for several weeks, and I don't know why it just now started to act as a DHCP server, or why anyone would put a DHCP server on a printer.  Again, thank you all for your help.

Featured Post

Microsoft Certification Exam 74-409

Veeam® is happy to provide the Microsoft community with a study guide prepared by MVP and MCT, Orin Thomas. This guide will take you through each of the exam objectives, helping you to prepare for and pass the examination.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

If you’re involved with your company’s wide area network (WAN), you’ve probably heard about SD-WANs. They’re the “boy wonder” of networking, ostensibly allowing companies to replace expensive MPLS lines with low-cost Internet access. But, are they …
In this article, the configuration steps in Zabbix to monitor devices via SNMP will be discussed with some real examples on Cisco Router/Switch, Catalyst Switch, NAS Synology device.
Internet Business Fax to Email Made Easy - With  eFax Corporate (http://www.enterprise.efax.com), you'll receive a dedicated online fax number, which is used the same way as a typical analog fax number. You'll receive secure faxes in your email, f…
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…

864 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question