RBR40 and RBS40 generate different subnets for attached devices

[PFi]

I use RBR40/RBS40 mesh. Despite the fact that I have defined the subnet (192.168.0.x) for the LAN TCP/IP and directed to use Router as DHCP server with the starting and ending IP addresses within the same subnet, somehow the wireless devices connected to the LAN get not only the addresses in the abovementioned range, but also in the range of subnet 172.27.35.x.
Why is this, and how I may prevent it from happening?  

[PFi · Accepted solution]

I have found the "rogue" DHCP. My VoIP device had the internal DHCP server enabled. I turned it off, and the issue went away.

Thank you very much for your help.

[FURRYe38]

Does the RBS show fully synced to the RBR on the RBRs web page? 

Has a factory reset and setup from scratch with a wired PC and web browser been performed? 

https://kb.netgear.com/22697/How-do-I-install-my-NETGEAR-router-using-the-router-web-interface

Might try this with the RBS in same room or near the RBR and setup from scratch using this process:

https://community.netgear.com/t5/Orbi-WIFI-6-AX-AND-Wi-Fi-6E-AXE/Procedure-for-Factory-reset-of-RBS8...

[CrimpOn]

There are several groups of IP addresses reserved for private networks:

https://en.wikipedia.org/wiki/Private_network 

The most common reason for this is another DHCP server on the network.  When devices broadcast a DHCP request, they accept the first response. 

Is is always the same devices that get the unexpected IP address?  Do they have anything in common (such as all being Sonos speaker units)?  Do they sometimes get the expected IP address?

Testing this hypothesis is not trivial.  This article presents some options:

https://serverfault.com/questions/8526/how-do-i-find-if-there-is-a-rogue-dhcp-server-on-my-network 

Probably the quickest is to disable the router DHCP service temporariliy and see if devices continue to get IP address assignments.

[PFi]

@FURRYe38 
Thank you for your response.
I am not sure what the "fully synced" means.  The attached devices tab shows devices connected to both the router RBR-40 and the to the satellite RBS-40. Moreover, the devices with IP addresses from both subnets appear connected to both router and satellite.

[PFi]

@CrimpOn 

Thank you for your response.

I ran

ipconfig /all | find /i "DHCP Server"

 and received a single row response

 DHCP Server . . . . . . . . . . . : 192.168.0.1

[FURRYe38]

Fully Sync means the status shown on the RBRs web page shows GOOD or Wired for RBS that are ethernet connected. 

Can you log into the RBS web page at it's assigned 192.168.0.# IP address? 

Which devices are getting the different IP address from 192? 

What Firmware version is currently loaded on the RBR and RBS?
What is the Mfr and model# of the Internet Service Providers modem/ONT the NG router is connected too?

---

@PFi wrote:

@FURRYe38 
Thank you for your response.
I am not sure what the "fully synced" means.  The attached devices tab shows devices connected to both the router RBR-40 and the to the satellite RBS-40. Moreover, the devices with IP addresses from both subnets appear connected to both router and satellite.

---

[PFi]

@FURRYe38 

The status is GOOD.
To that "rogue" subnet connected all kind of devices, such as TVs, security, a tablet, a VoIP phone, Roku, a speaker.

The router firmware version is V2.7.4.24.

The modem is Netgear Genie CM1150V firmware version V4.12.04.

[FURRYe38]

Do these rogue IPs show up on the RBRs web page for each of these devices? 

Can you post a screen capture of the RBRs web page with the MAC addresses redacted out? 

Have you attempted to turn OFF all of these devices and then check the RBRs web page for devices, then turn them ON, one at a time then check the RBR web page and device to see what IP address gets assigned? Graduate turn them on one at a time to check the RBR and device? 

[CrimpOn]

@PFi

• Turned on DHCP server on a Raspberry Pi on the network Using a DHCP pool of 192.168.1.201 to 192.168.1.251  The Pi  has two network interfaces: 192.168.1.29 (WiFi) and 192.168.1.30 (Ethernet)
• Started Wireshark to capture every packet going through my PC's Ethernet port.
• Ran the same command (

  ipconfig /all | find /i "DHCP Server"​and got NOTHING.

• Then I ran the command ipconfig /renew, and Wireshark recorded this:
  
   The Orbi (192.168.1.1) and both Raspberry Pi network connections responded with DHCP offers.  Because the Orbi offer was received first, it was the one the PC accepted.

• So, I am somewhat at a loss to understand the situation. (Like, why does that command work for you and not for me.)  Most of the internet hits I got on searching for DHCP servers are at least 10-12 years old. (There were a bunch of programs written about 2009!)

  These devices with the strange IP addresses:

  • They have only a single network adapter?
  • They show up in the Orbi Attached Devices list only once?
  • This strange IP address shows up in the Orbi Attached Devices list?

[PFi]

@FURRYe38 

Thank you for the response.

As I mentioned earlier, the devices from both subnets appear connected to both RBR and RBS.

There are over 30 devices connected to the network, and it would be difficult to scrape screenshot from the information I would not want to share such as list of devices, MAC addresses, etc.

For the same reason turning OFF ALL of these devices would be impractical. Among them many IoT, security, HVAC, and other devices.

I suspected that either my HVAC system or security system had its own DHCP server and had created a separate subnet for its devices. However, that does not seem to be the case, as the HVAC and security devices are distributed across both those subnets.

[PFi]

@CrimpOn 

I am sorry. I do not understand your response. Have you posed it to the wrong threat?

[CrimpOn]

This was an example of documenting multiple DHCP servers on a network. Although the topic of "how to find rogue DHCP servers?" has been around for a LONG time, there appear to be few options.  When I tried using the Windows feature on my computer, it failed to report ANY DHCP servers at all, even though there obviously is one.

As a test, I deliberately set up a DHCP server and used a packet capture program (Wireshark) to record what happened when the PC asked to renew the IP assignment.  Sure enough, DHCP offers were recorded from the Orbi router and from this other DHCP server.  Thus, a packet capture process appears to document "who is out there serving DHCP?"

Wireshark is free for Windows, Mac, and Linux.

Internet search finds other programs specifically devoted to documenting DHCP servers on a network, but when I tried to download them, most are no longer available.

Since it is impractical to turn off all 30 devices, it is probably NOT one of the devices which has been assigned an incorrect IP address.

I am still confused about how these devices show up in the Attached Devices display.  Does the Orbi actually display them with that rogue  IP  address?

[FURRYe38]

If you can turn them ALL off at once, then I would start by turning OFF one item at a time to see if it disappears from the system. Start with what you suspect first. 

@PFi 

[PFi]

@CrimpOn 

As I mentioned in one of my previous responses, I have over 30 devices connected to the Orbi mesh network.

Of those about the third connected to the "rogue" subnet 172.27.35.x. The rest are connected to the "prescribed" subnet 192.168.0.x.
Of the devices on the "rogue" subnet about the equal number connected to RBR and RBS.
To answer you how the "rogue" addresses are listed on the "Attached Devices" page, just imagine that in the column "IP Address" you see two kind of addresses: one kind starts with 192.168.0. and another start with 172.27.35. and the are mixed in the order.

I have downloaded WireShark and will try it later, when I have a bit more time.

[CrimpOn]

Thanks.  Each device displays only one IP address? or do some devices appear two times in the display?

I am having a bit of confusion over how the heck the Orbi can communicate with devices in a different IP subnet.

[PFi · Accepted solution]

I have found the "rogue" DHCP. My VoIP device had the internal DHCP server enabled. I turned it off, and the issue went away.

Thank you very much for your help.

[FURRYe38]

Glad you found the issue. Be sure to save off a back up configuration to file for safe keeping. Saves time if a reset is needed.
https://kb.netgear.com/000062080/How-do-I-back-up-the-configuration-settings-on-my-Orbi-WiFi-System
Enjoy. 📡