Users getting wrong IP addresses

Tiras25
Tiras25 used Ask the Experts™
on
Wired users getting 192.168.1.x IP address.  Instead of 10.10.x.x
Not sure what happened.   Not all the users tho.  Any ideas?
ipconfig /renew /release not helping.  
Need some help troubleshooting.
Comment
Watch Question

Do more with

Expert Office
EXPERT OFFICE® is a registered trademark of EXPERTS EXCHANGE®
Senior Software Developer
Commented:
ipconfig /renew won't help in this case because the wired users are indeed getting DHCP information. All you're doing with an ipconfig /renew is asking the same DHCP server for updated information.

What's apparently happening here is that these wired users are connecting to a different network. The best case scenario is that your router has been configured to use a different subnet for wired vs. wireless network. The worst case scenario is that someone has hijacked some or all of your wired connections somehow (i.e. they're being rewired). Check to make sure that plugging the device in to the ethernet jack corresponds to a link light being activated on your switch.

Author

Commented:
Happening with only 3 machines.  They were working previously.  Not sure what changed.  No changes has been done.  
Still looking..
Russ SuterSenior Software Developer

Commented:
Odd. Definitely check to make sure there's a link light on your switch that corresponds to the connection. What are you using for a DHCP server? The DHCP server should have a table which shows what leases currently exist.
Ensure you’re charging the right price for your IT

Do you wonder if your IT business is truly profitable or if you should raise your prices? Learn how to calculate your overhead burden using our free interactive tool and use it to determine the right price for your IT services. Start calculating Now!

Author

Commented:
yes there's a link light.
windows ad server for dhcp.
Kent WSr. Network / Systems Admin

Commented:
Sounds suspiciously like a rogue dhcp server on your network. Anything been added? Router? Phone switch, etc? Anything that defaultly comes with dhcp service would be suspect.
Since it's wired, you may be able to physically trace what is different about where these three machines are plugged in by tracing the physical wires / ports.
Prabhin MPDevOps Engineer
Distinguished Expert 2018

Commented:
can u check any wire looped in switch
Qlemo"Batchelor", Developer and EE Topic Advisor
Top Expert 2015

Commented:
ipconfig /all should show the DHCP server IP, and that might be helpful. Most likely it is 192.168.1.1. Looking up the MAC adddress using arp -a after having pinged that server IP, and researching the manufacturer part of it, gives a clue about the device brand. If you've got managed switches, the MAC address can get followed to ports there.
Distinguished Expert 2018

Commented:
Do you have managed switches? You could use them to track for signs of a weird MAC address somewhere on your network.

One of the odd situations I had seen was a case where a user felt they didn't have enough ports at their workstation. Turned out they bought a router instead of a switch, then connected one of the LAN ports directly to the network outlet. Caused several hours worth of headaches.

Author

Commented:
Figured out.  Security contractor connected their linksys router into our switches.  That caused the issue.  Disconnected and problem is gone now.  Thanks!
Qlemo"Batchelor", Developer and EE Topic Advisor
Top Expert 2015

Commented:
Sorry having to say that, but I cannot see how Russ' comments where helpful in this case?

Kent's comment #a42638166, my comment #a42638368 and masnrock's #a42638649 are all better choices for accepted/assisted answers.

Author

Commented:
Russ' first comment was helpful in this case.
Qlemo"Batchelor", Developer and EE Topic Advisor
Top Expert 2015

Commented:
Very questionable. It has been a rogue DHCP server, which came in by plugging in a router. Not someone rewiring network ports, as guessed by Russ.

Author

Commented:
>> What's apparently happening here is that these wired users are connecting to a different network.>>
This is exactly what was happening.  Russ nailed it.

Do more with

Expert Office
Submit tech questions to Ask the Experts™ at any time to receive solutions, advice, and new ideas from leading industry professionals.

Start 7-Day Free Trial