Tell me more ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.
up vote -2 down vote favorite

Strange things are going on our network. Since yesterday a host which is actually not on our subnet spreads wrong ARP Replys on our network. To be precise, only on the WIFI. If I connect my Laptop to the cable ethernet, it gets the right MAC adress of the router. Also my Android phone and my Ubuntu system do get the right MAC Adress. So I took a look at wireshark. When I clear the ARP cache of the windows machine, the first ARP response is correct and comes from the router. But like 10 ms later another ARP response comes from another host in the WIFI. The host changes its IP Adresses from time to time and they look like they are not on our subnet. So I can not use the internet because DNS is not working anymore. Sometimes the router wins the race condition and the mac adress is set correctly in the arp cache. I first thought, this is an arp-poisoning mitm attack but it does not make sense if the packets get not routed correctly?! I restarted the router but it didn't help. I have no access to the router, else I would change the shared key to make sure there is no intruder on the wifi.

share
Apparently, someone has connected a misconfigured device to the network. Let the network administrator take care of it. Without access to the router, there's not much you can do. (Perhaps another router with the same SSID/key was left plugged in by mistake?) – David Schwartz Oct 8 '12 at 12:52

migrated from superuser.com Oct 8 '12 at 13:54

closed as off topic by Ward, mdpc, EEAA, Scott Pack, WesleyDavid May 20 at 5:03

Questions on Server Fault are expected to relate to professional server, networking, or related infrastructure administration within the scope defined in the FAQ. Consider editing the question or leaving comments for improvement if you believe the question can be reworded to fit within the scope. Read more about closed questions here.

2 Answers

up vote 3 down vote

Looks like a rogue AP. Get out something you can measure wireless signal strength with, track it down and unplug it.

See also:

share
up vote 0 down vote accepted

So we figured out the problem.

I live in a shared flat and the owner of this shared flat has another flat in this house. To save money they installed on the second flat a router without internet connection and connected it somehow to our router.

ARP request for gateway 192.168.1.1 got answered by both routers, which seems to confuse especially the windows systems. So if the router without Internet connection was written to the arp cache as 192.168.1.1, of course it could not route the requests to the internet. Cable unplugged, second router got it's own internet connection, problem solved!

Thanks for all replies ;)

share

Not the answer you're looking for? Browse other questions tagged or ask your own question.