NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
netadmn
Apr 18, 2018Apprentice
sattelites disconnecting users, arp showing 192.168.1.250 flip flopping between sattelites
I have the RBK53 system. I have it setup in AP mode with the base router setup with ip address 192.168.1.2. I have DHCP reservations for my satellites to get IP 192.168.1.3 and 192.168.1.4. My cl...
FURRYe38
Apr 19, 2018Guru - Experienced User
So can you remove the firewall and switch from the mix and connect everything directly between the router and satellite?
I would remove the printers IP address from the mix and set it to a different IP address. I use a static IP address on my printers here thats outside of the routers default IP address pool of 192.168.#.100 to 200. Anything on either side of this pool can be used for static IP addresses.
My priinters use part of there model number as there last octel IP address to make it kind of intuitive to what they are. LaserJet P2014n as 192168.0.14 as an example.
netadmn
Apr 19, 2018Apprentice
What do you mean by remove the firewall and switch from the mix? My goal is to have this RBK53 system running in AP mode only because there are a lot of advanced features I use that Orbi doesn't provide. Before this pfsense box, I had a sophos home utm as my firewall and the asus ac66u running for about 5 years. The asus just wasn't able to handle the amount of devices I've added over the years so I'm migrating to a new setup.
The printer is currently not in the mix. It is unplugged and is not communicating on the network. If I turn it on, the arp entry is updated with the printer MAC as I would expect. I can and will certainly change the static IP address and it is currently outside of my DHCP scope as you have mentioned.
The current topology is FIOS ONT <-> UNTAGGED VLAN2 NETGEAR SWITCH UNTAGGED VLAN2 <-> sg-3100 <-> UNTAGGED VLAN1 NETGEAR SWITCH UNTAGGED VLAN1 <-> ORBI "router" in AP mode <-> 5Ghz wireless connection to satellite is star (not daisy chain). The Orbi "router" reports Backhaul Status "Good" on both satellites.
I can see the satellites constantly pinging the gateway and I'm not seeing ICMP from 192.168.1.250... just arp broadcasts.
10:28:39.702050 8c:3b:ad:ad:d1:1e > 00:08:a2:0d:28:e4, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 44159, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.1.3 > 192.168.1.1: ICMP echo request, id 54788, seq 39329, length 64
10:28:39.702104 00:08:a2:0d:28:e4 > 8c:3b:ad:ad:d1:1e, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84, bad cksum 0 (->b754)!)
192.168.1.1 > 192.168.1.3: ICMP echo reply, id 54788, seq 39329, length 64
10:28:39.978127 8c:3b:ad:ad:bb:48 > 00:08:a2:0d:28:e4, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 61834, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.1.4 > 192.168.1.1: ICMP echo request, id 29530, seq 39395, length 64
10:28:39.978163 00:08:a2:0d:28:e4 > 8c:3b:ad:ad:bb:48, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84, bad cksum 0 (->b753)!)
192.168.1.1 > 192.168.1.4: ICMP echo reply, id 29530, seq 39395, length 64
10:28:40.277198 8c:3b:ad:ad:d1:1e > 00:08:a2:0d:28:e4, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 44188, offset 0, flags [DF], proto ICMP (1), length 84)
192.168.1.3 > 192.168.1.1: ICMP echo request, id 63291, seq 0, length 64
10:28:40.277241 00:08:a2:0d:28:e4 > 8c:3b:ad:ad:d1:1e, ethertype IPv4 (0x0800), length 98: (tos 0x0, ttl 64, id 0, offset 0, flags [DF], proto ICMP (1), length 84, bad cksum 0 (->b754)!)
192.168.1.1 > 192.168.1.3: ICMP echo reply, id 63291, seq 0, length 64
10:30:37.776047 8c:3b:ad:ad:bb:48 (oui Unknown) > ac:5f:3e:92:28:d4 (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has SAMSUNG-SM-G930V.mydomain.com (ac:5f:3e:92:28:d4 (oui Unknown)) tell 192.168.1.250, length 46
10:30:37.777802 8c:3b:ad:ad:bb:48 (oui Unknown) > c4:8e:8f:fa:a1:09 (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.127 (c4:8e:8f:fa:a1:09 (oui Unknown)) tell 192.168.1.250, length 46
10:30:37.777927 8c:3b:ad:ad:bb:48 (oui Unknown) > f0:27:2d:55:a5:2d (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.124 (f0:27:2d:55:a5:2d (oui Unknown)) tell 192.168.1.250, length 46
10:30:37.778935 8c:3b:ad:ad:bb:48 (oui Unknown) > f0:27:2d:29:e0:4f (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.126 (f0:27:2d:29:e0:4f (oui Unknown)) tell 192.168.1.250, length 46
10:30:37.779081 8c:3b:ad:ad:bb:48 (oui Unknown) > 9c:ad:ef:62:68:af (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has OBi200.mydomain.com (9c:ad:ef:62:68:af (oui Unknown)) tell 192.168.1.250, length 46
10:30:37.779287 8c:3b:ad:ad:bb:48 (oui Unknown) > bc:54:51:8c:4c:38 (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.15 (bc:54:51:8c:4c:38 (oui Unknown)) tell 192.168.1.250, length 46
10:30:37.779293 8c:3b:ad:ad:bb:48 (oui Unknown) > 00:08:a2:0d:28:e4 (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has pfSense.mydomain.com (00:08:a2:0d:28:e4 (oui Unknown)) tell 192.168.1.250, length 46
10:30:37.779447 8c:3b:ad:ad:bb:48 (oui Unknown) > ac:5f:3e:92:28:d4 (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has SAMSUNG-SM-G930V.mydomain.com (ac:5f:3e:92:28:d4 (oui Unknown)) tell 192.168.1.250, length 46
10:30:37.779628 8c:3b:ad:ad:bb:48 (oui Unknown) > c4:8e:8f:fa:a1:09 (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.127 (c4:8e:8f:fa:a1:09 (oui Unknown)) tell 192.168.1.250, length 46
10:30:37.779774 8c:3b:ad:ad:bb:48 (oui Unknown) > f0:27:2d:55:a5:2d (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.124 (f0:27:2d:55:a5:2d (oui Unknown)) tell 192.168.1.250, length 46
10:30:37.871268 8c:3b:ad:ad:d1:1e (oui Unknown) > f0:27:2d:29:e0:4f (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.126 (f0:27:2d:29:e0:4f (oui Unknown)) tell 192.168.1.250, length 46
10:30:37.872688 8c:3b:ad:ad:d1:1e (oui Unknown) > 9c:ad:ef:62:68:af (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has OBi200.mydomain.com (9c:ad:ef:62:68:af (oui Unknown)) tell 192.168.1.250, length 46
10:30:37.873047 8c:3b:ad:ad:d1:1e (oui Unknown) > f0:27:2d:29:e0:4f (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.126 (f0:27:2d:29:e0:4f (oui Unknown)) tell 192.168.1.250, length 46
10:30:37.873222 8c:3b:ad:ad:d1:1e (oui Unknown) > bc:54:51:8c:4c:38 (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has 192.168.1.15 (bc:54:51:8c:4c:38 (oui Unknown)) tell 192.168.1.250, length 46
10:30:37.873228 8c:3b:ad:ad:d1:1e (oui Unknown) > 00:08:a2:0d:28:e4 (oui Unknown), ethertype ARP (0x0806), length 60: Ethernet (len 6), IPv4 (len 4), Request who-has pfSense.mydomain.com (00:08:a2:0d:28:e4 (oui Unknown)) tell 192.168.1.250, length 46
The question remains: If the satellites are getting an IP address via DHCP (I can't find how to set them static), then why are they not using that address for arp resolution/broadcasts. As you can see from the traffic capture, the satellites are using the 192.168.1.250 at the same time.
- netadmnApr 19, 2018Apprentice