Users getting wrong IP addresses

Wired users getting 192.168.1.x IP address.  Instead of 10.10.x.x
Not sure what happened.   Not all the users tho.  Any ideas?
ipconfig /renew /release not helping.  
Need some help troubleshooting.
LVL 17
Tiras25Asked:
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Russ SuterSenior Software DeveloperCommented:
ipconfig /renew won't help in this case because the wired users are indeed getting DHCP information. All you're doing with an ipconfig /renew is asking the same DHCP server for updated information.

What's apparently happening here is that these wired users are connecting to a different network. The best case scenario is that your router has been configured to use a different subnet for wired vs. wireless network. The worst case scenario is that someone has hijacked some or all of your wired connections somehow (i.e. they're being rewired). Check to make sure that plugging the device in to the ethernet jack corresponds to a link light being activated on your switch.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Tiras25Author Commented:
Happening with only 3 machines.  They were working previously.  Not sure what changed.  No changes has been done.  
Still looking..
Russ SuterSenior Software DeveloperCommented:
Odd. Definitely check to make sure there's a link light on your switch that corresponds to the connection. What are you using for a DHCP server? The DHCP server should have a table which shows what leases currently exist.
Monitor Your Cisco ASA Like an Expert

View VPN tunnel status and get help monitoring firewall high availability, health, and readiness. Be able to automate the monitoring and management of your ASA infrastructure in a fully integrated solution with Network Insight™ for Cisco® ASA.

Tiras25Author Commented:
yes there's a link light.
windows ad server for dhcp.
Kent WSr. Network / Systems AdminCommented:
Sounds suspiciously like a rogue dhcp server on your network. Anything been added? Router? Phone switch, etc? Anything that defaultly comes with dhcp service would be suspect.
Since it's wired, you may be able to physically trace what is different about where these three machines are plugged in by tracing the physical wires / ports.
Prabhin MPEngineer-TechOPSCommented:
can u check any wire looped in switch
Qlemo"Batchelor", Developer and EE Topic AdvisorCommented:
ipconfig /all should show the DHCP server IP, and that might be helpful. Most likely it is 192.168.1.1. Looking up the MAC adddress using arp -a after having pinged that server IP, and researching the manufacturer part of it, gives a clue about the device brand. If you've got managed switches, the MAC address can get followed to ports there.
masnrockCommented:
Do you have managed switches? You could use them to track for signs of a weird MAC address somewhere on your network.

One of the odd situations I had seen was a case where a user felt they didn't have enough ports at their workstation. Turned out they bought a router instead of a switch, then connected one of the LAN ports directly to the network outlet. Caused several hours worth of headaches.
Tiras25Author Commented:
Figured out.  Security contractor connected their linksys router into our switches.  That caused the issue.  Disconnected and problem is gone now.  Thanks!
Qlemo"Batchelor", Developer and EE Topic AdvisorCommented:
Sorry having to say that, but I cannot see how Russ' comments where helpful in this case?

Kent's comment #a42638166, my comment #a42638368 and masnrock's #a42638649 are all better choices for accepted/assisted answers.
Tiras25Author Commented:
Russ' first comment was helpful in this case.
Qlemo"Batchelor", Developer and EE Topic AdvisorCommented:
Very questionable. It has been a rogue DHCP server, which came in by plugging in a router. Not someone rewiring network ports, as guessed by Russ.
Tiras25Author Commented:
>> What's apparently happening here is that these wired users are connecting to a different network.>>
This is exactly what was happening.  Russ nailed it.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Networking Hardware-Other

From novice to tech pro — start learning today.