I'm running a small network with a peplink router and unifi access points. The wireless network is a vlan than has no access to the main network.

For some reason that I can not figure out, some random devices are getting a different subnet of ips assigned to them.

The only thing I can figure is that something is connecting wirelessly to the network and acting as a dhcp server. But how do I find it if changing the password is not an option?

  1. Put one or more clients on the network.
  2. Start up a packet capture on them.
  3. Perform DHCP requests and observe the IP of the DHCP server.
  4. Repeat from various locations on the network until you have seen a reply from an unexpected IP.
  5. Once you have the IP, you can get the MAC of the offending system and then track it down using the CAM tables (or equivalent) of your switch and wireless gear.

Note: Consider enabling DHCP snooping on your switches - with this you can ensure that only authorized servers can respond to DHCP requests.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.