Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Our DC is a Win2k3 box that also does DHCP for the domain. I was having some network issues the other day that turned out to be DNS related and resolved those. Anyway, when I was running diagnostics I noticed there were multiple default gateways listed which I knew wasn't how I had the DHCP scope configured on the server. The extra gateway was an odd IPv6 address that resolves to one of our users laptops of all things. The laptop's IPv6 address was listed as having higher precedence over the correct router address to boot.

How in the world does our DC (or maybe it's the individual machines scanning the network?) see the laptop as a gateway and then advertise that fact to any computer on the domain? Is there something that might be doing this on the laptop or should I be looking for something on the DC/DHCP server? I've run ipconfig /flushdns & /release & /renew to see if it was an artifact but nothing seems to get rid of that IPv6 gateway.

Here is the ipconfig output:

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . : 
   Description . . . . . . . . . . . : Intel(R) 82577LM Gigabit Network Connection
   Physical Address. . . . . . . . . : 00-26-2D-FE-08-7D
   DHCP Enabled. . . . . . . . . . . : Yes
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::bc59:7a8d:411b:c7db%11(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.10.174(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Lease Obtained. . . . . . . . . . : Tuesday, January 25, 2011 11:48:21 AM
   Lease Expires . . . . . . . . . . : Wednesday, January 26, 2011 11:48:21 AM
   Default Gateway . . . . . . . . . : fe80::94ab:7bda:554a:6598%11
                                       192.168.10.1
   DHCP Server . . . . . . . . . . . : 192.168.10.200
   DHCPv6 IAID . . . . . . . . . . . : 234890797
   DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-14-2D-C5-DB-00-26-2D-FE-08-7D
   DNS Servers . . . . . . . . . . . : 192.168.10.100
                                       68.105.28.16
   Primary WINS Server . . . . . . . : 192.168.10.200
   NetBIOS over Tcpip. . . . . . . . : Enabled

EDIT: closing this as the user and laptop haven't been in the office for awhile. Problem most likely due to some malware as suggested below.

share|improve this question
add comment

1 Answer

up vote 3 down vote accepted

Unplug that laptop!!

Reboot a test machine, and then see what configuration is given to that machine. you might want to sniff your network traffic, just to make sure that there are not any other machines intentionally sending data to their 'rogue' gateway.

There are man in the middle attacks which require gateway configuration to be hijacked - I would test this out.

share|improve this answer
1  
This looks like a nasty trojan, running a rogue DHCP server. Do check your server; maybe it's infected too! –  DutchUncle Jan 25 '11 at 18:10
    
Definitely seems possible, just ran wireshark and found that laptop advertising itself as a router and soliciting itself as a neighbor extremely frequently. Seems interesting that it only does it on the IPv6 interface. It does appear to be the only machine behaving this way at least so I think if it is infected it is localized...time for some malware scans yippee. –  Diffuser Jan 25 '11 at 18:51
    
Had the user run malwarebytes and didn't find anything suspicious. They have left for the day so I'll have to check with something else tomorrow. The gateway listing went away after the user disconnected. Doesn't appear to be Flush.M because the DNS entries are untouched..just weird. They didn't have the MS DHCP server service running but maybe it's something else that's not malicious. –  Diffuser Jan 25 '11 at 21:02
    
Hopefully not - But there are live IP6 based exploits out there, mainly because most network admins are not using IP6, so are not actively looking for it. Try logging all the IP6 packets across your network for a few days, give you a sense of any more traffic. It could be that that users laptop is a victim, rather than a source. –  Mister IT Guru Jan 26 '11 at 14:08
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.