I have a vexing recent issue on what has been, for the most part, a very reliable home network. Since it is a hobby for me, it’s probably a little more complicated than the average home, but it’s still just a single subnet, one router / gateway home LAN. Here is the general topography.
I have about a dozen PC’s on the network, most of which are Ethernet hard wired. The laptops that are not wired use Wi-Fi but are typically assigned a static IP address. There are a couple of older laptops that use DHCP.
There is also a bunch of Wi-Fi connected phones, tablets, TV’s, a NEST thermostat, and a few other accessories most of which use DHCP assignment, but many have a “reserved” address in the router.
There are a few other wired DHCP devices (like Silicon Dust Tuner and DVR) hat cannot be set to static IP addresses, hence they get assigned as needed, but they usually get the same assigned addresses every time. It’s rare for them to change.
Importantly, I also have 5 Synology NAS boxes of various sizes and ages, that are all wired and are assigned consecutive static IP addresses for convenience.
My router / gateway / Wi-Fi are all in the Cox supplied Panoramic Wi-Fi box which has been working relatively trouble free for about 9 months.
I have my router divided into two ranges, whereby the DHCP range is carefully separated from the pool of addresses that I assign to static addresses.
Just FYI, I am using the common and conventional 192.168.0.1 – 254 (top half for static IP’s and back half allowed to the DHCP server) and the common 255.255.255.0 net mask.
Most of the wired stuff is connected with a number of unmanaged switches, except for some of my cameras running on an 8-port PoE Cisco managed small office switch.
Here is the problem;
The NAS boxes have started to pop up an occasional “Duplicate IP address” warning, despite all being assigned static IP’s and all being in the non-DHCP pool.
Through Wireshark, I was able to determine that a MAC address of 00:11:22:ab:cd:ee is occasionally “sharing”(or claiming to be) the IP address of one or more of the NAS boxes as well as other devices on my LAN. That MAC address is obviously “fake” as the digits are consecutive and do not trace back to a valid manufacturer.
When that MAC Address sends out an arp broadcast, the Source IP is often an IP address from outside my network, hence it will ask “Who has 192.168.0.xxx? Tell 22.214.171.124” or “..Tell 126.96.36.199” or any of a number of other “outside” IP addresses. I thought all arp requests had to be from and go to local IP addresses within the LAN.
Sometimes, when that suspect MAC address sends it’s request, it pretends to be from an IP address within my LAN, and hence a “Duplicate IP Address” error is generated. That’s what made me start looking for this problem and that’s when I discovered all the arp requests from that bogus MAC address (00:11:22:ab:cd:ee).
I am relatively sure that I have only one working DHCP server, the one built into the Cox box.
I have scoured net looking for clues and have found others whose networks report similar symptoms that mention that bogus MAC address, but none that have identified a cause or solution.
I am very good at following directions and will supply any other information as requested, if it is within my ability. I have these tools – Wireshark, XArp, a basic knowledge of the Administrative Command Prompt, and some LAN scanner software apps. But, I am by no means a network engineer or any kind of network expert. I am sure that I am what real network experts call "knows just enough to be dangerous" so please forgive me.
UPDATE - The craziness got worse after my original post, as the Cox Panoramic Gateway (Technicolor CGM4141) began to issue random ARP requests wherein it reported its OWN MAC address as the suspect 00:11:22:ab:cd:ee instead of the factory one. Also the behavior where it allowed ARP requests from IP addresses outside my network intensified. It was randomly reassigning MAC addresses to my devices, which began to look very much like a classic "Man-In-The-Middle" attack. I was beginning to sweat!
Once I caught it randomly changing its OWN MAC address, I called Cox support, who insisted that this was a problem for their "Complete Care Department" at a cost of $10 /mo, which they promptly signed me up for.
After explaining the problem to "Paul" he suggested that I perform a "hard" factory reset on the Gateway, which would wipe all my settings like SSID, passwords, and my DHCP address boundaries, which I could manually subsequently restore.
So, desperate to try for a solution, I pushed the reset button with a small paperclip, and waited about 12 minutes for the LED to turn solid white. I restored my critical settings (BTW, I could find no place to change my SSID and PASSWORD in the Gateway's GUI, or on the Cox Wi-Fi website. Turns out you HAVE to use their "APP" on a phone or tablet to do that.) and now it has been running for 2 hours with no glitches.
But, I spoke too soon, the Gateway is now resuming its former bad behavior, assigning "outside" MAC addresses to internal ARP requests.