NETGEAR is aware of a growing number of phone and online scams. To learn how to stay safe click here.
Forum Discussion
Orbi RBR750 w/ 2 Satellites and Arris SB8200 modem assigning wrong IP to devices (192. To 172.)
My Orbi RBR750 with two satellites is connected to ARRIS - SURFboard SB8200 DOCSIS 3.1 Cable Modem. Orbi firmware is V4.6.5.14. We recently had to unplug the system and ever since then we are having i...
KSKasia wrote:
router assigns some devices the 172.27 IP (or 169.) and that device won’t connect to the internet. How do I remedy this? I already reset both the modem and the Orbi and satellites and even renamed my network and changed passwords. Issue keeps coming back. Whenever a device is turned off or either assigns the correct IP address of 192. Or the wrong one 172. Help
There is a world of difference between a device having a private IP address https://en.wikipedia.org/wiki/Private_network which always begins with 10, 127, or 192 and a link-local IP address https://en.wikipedia.org/wiki/Link-local_address beginning with 169 which is created by the device when it cannot get an IP address from the network. These are totally different problems.
Does this happen to only certain devices or does it happen randomly to nearly every device at one time or another?
I suspect that there is a second DHCP server somewhere on the network that is giving out 172.27.x.x IP addresses. DHCP is a mechanism that is designed to allow for redundancy. There can be any number of DHCP servers on a network. When a device broadcasts a request for an IP address, it will accept the first response that it gets (even by a microsecond. first literally means first.) In a corporate environment, this allows DHCP servers to be taken off-line for maintenance while keeping the network operating, and it is a major chore to keep all the DHCP servers in sync.
It is not trivial to find a rogue DHCP server. Some speaker systems create their own network.
What I (personally) would do is hope there is a Windows or Linux computer on the network that exhibits this behavior. Install Wireshark on the computer to capture the network. Then deliberately do ipconfig/release and ipconfig/renew until an invalid IP appears and hope that the device that sent the invalid IP can identified from its hardware MAC address.
- It seems to have happen randomly to many devices. It has happened to my iPhone, MacBook, work computer, and Even the Ring cameras.
What is Wireshark? Would that only be on a PC? The only one I have is my work computer and I doubt they will let me install something on it.
It did start on that computer and I do use Pulse Secure to connect.Work almost certainly will not allow any apps to be installed on their computer.
However, Wireshark is available for MacOS. https://www.wireshark.org/#download
Is there a way to contact the IT department at work and ask them about the situation?
Specifically, it would be helpful to know:
- Which Pulse Secure software is installed on the work computer.
They have so many. Click on "Products" at the top of the page: https://www.pulsesecure.net/products/zero-trust-overview/ - Does the IP subnet 127.27 "ring a bell" to the IT Dept?
Would that happen to be the private IP subnet that they use? - Has anyone else encountered a similar problem when the work laptop is used at home?
Would it be possible to connect the work laptop to the Orbi Guest WiFi network? The default setting for Guest WiFi on my older Orbi model is to isolate devices on the Guest network from the primary network. (not sure about the 750, but imagine that it would be the same).
If the IT Dept and moving to the Guest WiFi do not solve the problem, searching for the rogue DHCP server would be a tedious process:
- Install Wireshark on the MacBook
- Open Wireshark and start a capture
- On the MacBook, force it to renew the IP address:
https://support.apple.com/guide/mac-help/renew-ip-address-dhcp-server-mac-mchlp1545/mac - Force a device to get a new IP address. This may take several attempts. Keep doing it until the MacBook gets an unacceptable IP address.
- Then go back to Wireshark and stop the capture.
- Create a Display Filter at the top of the Wireshark screen by entering "dhcp" (lower case) and clicking on the right arrow at the far right side of the Wireshark window.
- That will remove everything else and show only the DHCP packets.
- One of the dDHCP packets should contain that incorrect IP address and the MAC address on that packet will show where it came from.
There is (yet another) way to do this by having Orbi collect the LAN/WAN traffic for analysis.
I would not try Wireshark until (a) asking IT, and (b) moving the work laptop to the Guest WiFi network.
- Which Pulse Secure software is installed on the work computer.