UGN Security Forums UGN Security: Underground General DHCP Fiasco

Well today was a fun day at work. Today my boss comes running up to me telling me that the network is down. I go and check out the DSL Modem and see that everything seems to be fine. I get another call from someone else making the same claim. So I decide to go check it out.

Turns out overnight a group of computers decided to go from this:

IP: 192.168.1.x
Subnet: 255.255.255.0
Gateway: 192.168.1.1

To

IP: 10.0.1.x
Subnet: 255.255.255.0
Gateway: 10.0.1.1

After manually setting a few computers I was able to get everything back online. I then checked the DHCP settings of our lovely Westell 2200 Modem. Ofcourse all the settings were correct and everything seemed to be inorder. Two Service calls to Verizon brought forth no results, though I kinda realized I was screwed when one of the fixes was to turn off the PPPoE connection, and that they wanted to know the IP address of the Hub... This was after many attempts to get the computers to actually get an IP addy from the DHCP server. They all keep going back to the 10.0.1.x addresses.

I know I probably missed something and spent awhile combing the 'net. So like what's the deal?

Sounds like your DHCP server may not be available when these pc's are attempting to obtain a lease; is this an in house router, or are you using a switch to connect to your isp?

Well the DHCP Server is running off of the standard issue DSL Modem (Westell 2200) and that basically acts as the sole gateway and DHCP Server, all other connections go through a 16 Port Netgear Switch to their destinations.

Here's one of the error logs from on of the machines:

Feb 15 11:17pm The IP address lease 192.168.1.45 for the network address (MAC ADDY) has been denied by the DHCP server 0.0.0.0 (DHCP Server sent a DHCPNACK Message)

Feb 16 11:31am The IP address lease 10.0.1.2 for the network address (MAC ADDY) has been denied by the DHCP server 192.168.1.1 (DHCP Server sent a DHCPNACK Message)

Feb 16 11:43am The IP address lease 0.0.0.0 for the network address (MAC ADDY) has been denied by the DHCP server 192.168.1.1 (DHCP Server sent a DHCPNACK Message)

Feb 16 11:43am The IP address lease 0.0.0.0 for the network address (MAC ADDY) has been denied by the DHCP server 0.0.0.0 (DHCP Server sent a DHCPNACK Message)

Feb 16 2:21pm The IP address lease 10.0.1.2 for the network address (MAC ADDY) has been denied by the DHCP server 192.168.1.1 (DHCP Server sent a DHCPNACK Message)

After hard resetting the modem, reconfiguring our account information, and reinputting the DNS Settings I connected that same machine directly to the modem. I was then issued the proper address of 192.168.1.47. All the other machines on the switch however (after reconnecting the DSL Modem to the switch obviously) still hang on to their 10.0.1.x address no matter how many times I release and renew.

I can't figure out how to fix this, just further makes me want to re-set up the whole damn network.

Oh yeah, not sure how this would affect anything, but last night a client hooked up an AirPort Extreme. Any corrilation?