IP addresses issued are different from DHCP range assigned

I have a LAN with about 20 PCs (DHCP assigned) and a domain controller (static IP). The LAN has been relatively stable, but lately for some reason the PCs are starting to get assigned an IP address different (10.0.1.x) from what the DHCP server range is assigned to use (192.168.0.100-199). I have had the Comcast router changed out thinking it may be the problem, however it did not resolve the issue. There are also 2 Apple Express APs that provide wireless access to 192.160.0.x and one that provides guest access to a 192.168.1.1, 255.255.255.128 network. All the APS appear to be working properly. I am not sure why this occurring and have not seen any errors about more than one DHCP server on the network. Any suggestions would be most welcomed regarding where to start or a resolution. - Thx HBee
HDBee3Asked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

andreasSystem AdminCommented:
boot an affected machine with a knoppix dvd start wireshark and let the machine do some dhcp requests and see what happens.

from which mac address he will get what dhcp replys,

would be most effective way to see whats going on.
Dave BaldwinFixer of ProblemsCommented:
The default IP range for Comcast routers is 10.0.1.x.  At least it has been for the ones that I have had.
arnoldCommented:
Make sure to login into the Comcast router and disable the DHCP portion.

The issue you seem to have might be related t o where the Comcast cable is plugged into
Given you have two conflicting IPs , look at the network layout setup you expect versus how it is setup.

Internet <=> Comcast router <=> do you have an internal router <=> switch <=> LAN?
SolarWinds® Network Configuration Manager (NCM)

SolarWinds® Network Configuration Manager brings structure and peace of mind to configuration management. Bulk config deployment, automatic backups, change detection, vulnerability assessments, and config change templates reduce the time needed for repetitive tasks.

LEARN MORE
UnHeardOfCommented:
you can run ipconfig /all to see what the ip of the dhcp server is. then look at your arp cache to get the mac. look in the forwarding table of the switch and track down the switch port to identify the host.
Juan OcasioApplication DeveloperCommented:
i had the same issue. If you want to use your own IP range, make sure you disable bridge mode on the Comcast router
arnoldCommented:
Actually, if you do want to use your own IP, you need to enable bridge mode on comcast. I.e. the comcast router's functionality will only make sure to terminate the docsis connection with ethernet being passed to the router behind it.
In bridge mode, the comcast device will function as an adapter no routing/DHCP IP assignment from it..
HDBee3Author Commented:
There is no internal router other than the Comcast equipment. Oddly, the older SMC was the original DOCIS 2.0 modem that was in use when the problem began and has always been in the router mode. The fact that the PCs were pulling a 10.0.1.x IP led me to believe it was the modem/router since this is default Comcast IP address range. They replaced it with a Netgear 3000 series DOCIS 3.0  and it was also set up in the router mode (no bridge mode setup), however the problem remained. I did run an ipconfig/all and looked at the MAC of the DHCP server, it does not match the Comcast Netgear 3000. I'll have to look into the knoppix DVD, not familiar with it. I'm kinda doubting the Comcast equipment is at fault, but haven't ruled it out.
arnoldCommented:
Login into the Comcast router on IP 10.0.0.1 and change the settings reconfiguring its IP LAN range to match what you have configured and you would need to reboot the Comcast device after the changes.
vivigattCommented:
You certainly have more than one DHCP server on your LAN.
It can be a router/gateway, some other host, even a malware of some kind.

On this page :
http://blog.mir.net/2014/10/rogue-dhcp-server-detection-free-tool.html
you'll find a tool that will help you detect DHCP servers active on your LAN.

Use it and see what is the address of the server that sends DHCP offers to your hosts.
You can find the MAC addresses and have some ideas of the vendor of each DHCP server.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
HDBee3Author Commented:
Vivigatt, thanks for the url and info, I will certainly give this a try to see if it reveals anything and keep everyone posted.
HDBee3Author Commented:
The problem was accidentally created by myself. I had set up an Apple Express access point and had set it up to use NAT+DHCP to create a different subnet (10.0.1.x) for guest users. This was the same default range as the Comcast router. Turns out that after some investigation that the Apple was trying to do DHCP on the Ethernet connection? I disconnected it and all was back to normal. I then set it up in test environment and it worked as it should offering the 10.0.1.x addresses to the WiFi side.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
DHCP

From novice to tech pro — start learning today.