6

Sorry for my obscure title, I don't have much knowledge about networking. So today I got a really strange problem with my network, it's like this:

My network: From Internet → my Wi-Fi router → "black box" ("black box" means that one cable get out of my Wi-Fi router from the LAN ports group, go somewhere and I don't have access to that network, I don't know what's going on there)

My PC and cell phone connect to my Wi-Fi router (so the higher level network in the title means this network and the lower level network means the "black box").

Normally my devices have IP addresses like this:

  • My Wi-Fi router: 192.168.197.1
  • My PC: 192.168.197.101
  • My cell phone: 192.168.197.102

Today they changed, and my phone IP address became 192.168.21.106, and my PC IP address changed to 192.168.21.107.

Because I think that somehow the "black box" part conflict with my network, the 192.168.21.x came from the "black box" and it provides IP addresses for my devices, so I decided to try set a static IP address for my PC and my phone back with its normal IP address (kind of force they choose one specific IP address) and it works, I can connect to the Internet again.

So my question is "is it possible that a lower level network can provide IP addresses for the higher level network?". I feel really strange because I don't think a "slave" network can affect/sabotage "master" network like this so it leads to another question "how do I make sure that my network is a real master-slave?, or make sure the higher level network never gets IP addresses from anywhere else, but the primary router?".

Another thing I should add, I call it "black box", because I think my network should work with whatever network setup or happen in the "black box", so I don't like the solution like turn off/disable DHCP on "Black box" too much.

EDIT: I got two evidences tell me that the "black box" is the problem. One is that when I unplug the cable which connect to the "black box", 192.168.21.x is gone, everything back to normal, and two is that when I set my PC to the IP address 192.168.21.107 (IP address from "black box") I can connect to 192.168.21.1, and it's a management website of a Wi-Fi router (not mine).

5
  • 2
    have you checked the wifi router settings haven't changed?
    – DRP
    Jan 20, 2018 at 0:24
  • Yes, I checked, my wifi router settings still the same, I can't find anything relate to the 192.168.21.x
    – pc43
    Jan 20, 2018 at 0:26
  • 3
    Why is that cable connected to your LAN if you don't know where it goes and what is at the other end?
    – kasperd
    Jan 20, 2018 at 18:10
  • 2
    @kasperd Any sane network admin would cringe at the very thought of such a thing.
    – jbowman
    Jan 20, 2018 at 19:53
  • 1
    @kasperd Of course I know who use that cable , I just want to emphasize that I don't know what their setup are and I think I don't need to know, my network should be good with whatever setup of they. I consider this problem is a security hole of my network because they can sabotage my network anytime they want :(
    – pc43
    Jan 20, 2018 at 23:46

3 Answers 3

7

If there are two or more DHCP servers, the one that answers your query first will "win". Your computer or any other device has no concept of "higher level network" or so, until it gets the IP address for itself and learns the netmask and the IP address of the gateway – but unless you use static settings, these information comes from (any) DHCP server.

If your router was able to filter packets travelling between LAN ports, it could filter out unwanted DHCP communication. But most probably all the LAN ports form a hardware switch or hub and you cannot separate these ports with software firewall of the router. Communication between LAN and Wi-Fi is probably bridged at software level and in theory you could filter it.

Properly configured firewall (extra device) inserted between your router and the "black box" part of the network would filter unwanted DHCP communication.

What you seek is called "blocking rogue DHCP". One method is to set local firewalls on affected devices to only accept DHCP offers from your router by its MAC address, or at least to block the known rogue DHCP by its MAC address.

Assigning static IP addresses independent from DHCP is quite a sane solution in such a situation. Still, identifying rogue DHCP servers, cutting them off or making them stop is better.

4
  • Thanks for given me right words to search but after searching a bit I find that block rogue DHCP need pretty costly hardware like Cisco switches, I can't find anything relate to block rogue DHCP on my cheap wifi router (TP-Link WR841)
    – pc43
    Jan 20, 2018 at 4:55
  • 3
    Well "blocking rouge DHCP" is awfully sinister for a simple misconfigured / mismatched network.
    – jdwolf
    Jan 20, 2018 at 5:37
  • 1
    Why is your DHCP service wearing cosmetics? (In other words, I can't correct a single letter typo.)
    – T.J.L.
    Jan 20, 2018 at 8:43
  • 1
    @T.J.L. LOL. Writing in foreign language at 2 AM (in my timezone) gave funny effects. Fixed now, I think. Jan 20, 2018 at 9:17
5

Something else is assigning IP addresses. If two devices on a network are serving two separate IP subnet DHCP pools you will get unexpected results.

It sounds like this mystery cable is the culprit. Try disconnecting it and see if the renewed IP addresses go back to normal. Whichever DHCP server responds first is what net addresses you will wind up with. I.e., something downwind is responding before your Wi-Fi router assigns your IP addresses.

8
  • I just add a bit "evidences" and yes, when I disconnect that mystery cable, the problem is gone.
    – pc43
    Jan 20, 2018 at 0:49
  • 1
    Do you have access to this device if you ask? It sounds like they have this cable plugged into the lan side of their router. It should be plugged into the wan port. The wan port won't try to give out ip's. (This is assuming we are talking about home routers) or you could just tell them to turn off DHCP on their device, and use the same DHCP pool. There are other options, like a VLAN capable switch could fix this. Jan 20, 2018 at 0:56
  • Yeah, I thought about that too, I plan to do that but the owner of that device is not home now. But the second question still there, "how to make a real master-slave network, prevent this kind of problem happen?"
    – pc43
    Jan 20, 2018 at 0:59
  • 2
    You have two options, set the mystery device to a different subnet then yours i.e 192.168.50.x and make sure the wan port is connected to your devices lan port. Or you can configure the mystery router to not have a wan at all. you would set that device inside your network IP scheme with something like 192.168.197.254 turn off DHCP and connect the link from your lan side to the lan side of the mystery router. Hope this helps! Jan 20, 2018 at 1:10
  • @Tim_Stewart Whether it should be connected to the WAN or LAN port of the other device depends on how that other device is configured. Two layers of routers doing NAT is not a good idea. The simplest alternative is to disable DHCP on one of them and connect a LAN port on the downstream device to the upstream router. That way one can completely ignore all the routing capabilities of the downstream device. However if somebody accidentally did a factory reset of the downstream device a conflict would happen.
    – kasperd
    Jan 20, 2018 at 18:13
4

DHCP relies on IP broadcast when making a discovery. Authoritative DHCP will always answer these requests. Meaning if you have more than one of them on the same network segment then you'll get unpredictable behavior between which DHCP takes ownership of the network. If the DHCP is non-authoritative it will only answer requests on its subnet.

So you and your blackbox friend can agree to use separate IP subnets and use non-authoritative DHCP. Or you would need a managed switch which blocks broadcasts to and from that network port.

Also note when I say managed switch your router is ALSO a switch and if it has vlan features its also a managed switch.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .