I'm having some weird internet problems on campus. I know it's something simple, but it's a case where I need another set of eyes. I think I can explain the problem best by posting a tracert:
Tracing route to google.com [184.108.40.206] over a maximum of 30 hops: 1 3 ms 3 ms 3 ms 192.168.8.1 2 1 ms 1 ms 1 ms elissaemily-pc.york.edu [192.168.10.5] 3 2 ms 2 ms 2 ms rrcs-76-79-19-33.west.biz.rr.com [220.127.116.11] 4 31 ms 3 ms 2 ms ge-1-1-0.lnclne00-mx41.neb.rr.com [18.104.22.168] 5 20 ms 17 ms 17 ms ge-7-3-0.chcgill3-rtr1.kc.rr.com [22.214.171.124] 6 20 ms 20 ms 19 ms ae-5-0.cr0.chi30.tbone.rr.com [126.96.36.199] 7 19 ms 19 ms 24 ms ae-1-0.pr0.chi10.tbone.rr.com [188.8.131.52] 8 26 ms 24 ms 24 ms 184.108.40.206 9 23 ms 24 ms 21 ms 220.127.116.11 10 39 ms 39 ms 55 ms 18.104.22.168 11 39 ms 39 ms 39 ms 22.214.171.124 12 39 ms 40 ms 96 ms 126.96.36.199 13 39 ms 39 ms 39 ms yx-in-f147.1e100.net [188.8.131.52] Trace complete.
Note the second entry in there. Not only is the host name a student's computer, but the ip address doesn't exist. Dhcp shows that host as having a different address and you can't ping any 192.168.10.5. Yet somehow it's routing packets for us (and not very well, either — things are slow right now). The rest of the tracert looks fine (we have a 20Mb fiber connection from road runner). A tracert from the admin vlan (10.x.x.x subnet) shows expected results.
The basic network routing table looks like this:
Destination Subnet Mask Gateway --------------------------------------- Default Route -- 10.1.1.5 (our firewall) 10.0.0.0 255.0.0.0 -- 192.168.8.0 255.255.252.0 --
Here's the whole story for the curious.
Several weeks ago we increased the IP range for the students from 192.168.8.0/23 to 192.168.8.0/22. To make this possible, we had to remove an old and now unused 192.168.10.0/24 range from the dhcp server and corresponding interface from our main switch. We finished this project and things seemed to work for a while.
Unfortunately, we missed a detail on the firewall. It had an interface set up for 192.168.10.5/24 that was there to serve the old range (the mystery router, right where it's supposed to be). It worked at first because most devices on the student network would still get IPs in the first part of the range. If anyone complained, by the time we checked it out they'd restart their computer and get a working IP address.
We didn't really have a problem until after spring break, when all the students came back at once. There were a few dhcp conflicts, a few new devices, and I'd reconfigured a couple consumer wireless routers I have to use to work like access points. All of a sudden we had many more devices getting 192.168.10.x addresses. Enough that it confused the firewall itself even and caused slowdowns across campus, if you could connect at all.
I'm glad to have this one fixed, let me tell you.