1

I have a vexing recent issue on what has been, for the most part, a very reliable home network. Since it is a hobby for me, it’s probably a little more complicated than the average home, but it’s still just a single subnet, one router / gateway home LAN. Here is the general topography.

I have about a dozen PC’s on the network, most of which are Ethernet hard wired. The laptops that are not wired use Wi-Fi but are typically assigned a static IP address. There are a couple of older laptops that use DHCP.

There is also a bunch of Wi-Fi connected phones, tablets, TV’s, a NEST thermostat, and a few other accessories most of which use DHCP assignment, but many have a “reserved” address in the router.

There are a few other wired DHCP devices (like Silicon Dust Tuner and DVR) hat cannot be set to static IP addresses, hence they get assigned as needed, but they usually get the same assigned addresses every time. It’s rare for them to change.

Importantly, I also have 5 Synology NAS boxes of various sizes and ages, that are all wired and are assigned consecutive static IP addresses for convenience.

My router / gateway / Wi-Fi are all in the Cox supplied Panoramic Wi-Fi box which has been working relatively trouble free for about 9 months.

I have my router divided into two ranges, whereby the DHCP range is carefully separated from the pool of addresses that I assign to static addresses.

Just FYI, I am using the common and conventional 192.168.0.1 – 254 (top half for static IP’s and back half allowed to the DHCP server) and the common 255.255.255.0 net mask.

Most of the wired stuff is connected with a number of unmanaged switches, except for some of my cameras running on an 8-port PoE Cisco managed small office switch.

Here is the problem;

The NAS boxes have started to pop up an occasional “Duplicate IP address” warning, despite all being assigned static IP’s and all being in the non-DHCP pool.

Through Wireshark, I was able to determine that a MAC address of 00:11:22:ab:cd:ee is occasionally “sharing”(or claiming to be) the IP address of one or more of the NAS boxes as well as other devices on my LAN. That MAC address is obviously “fake” as the digits are consecutive and do not trace back to a valid manufacturer.

When that MAC Address sends out an arp broadcast, the Source IP is often an IP address from outside my network, hence it will ask “Who has 192.168.0.xxx? Tell 35.162.54.217” or “..Tell 152.199.24.108” or any of a number of other “outside” IP addresses. I thought all arp requests had to be from and go to local IP addresses within the LAN.

Sometimes, when that suspect MAC address sends it’s request, it pretends to be from an IP address within my LAN, and hence a “Duplicate IP Address” error is generated. That’s what made me start looking for this problem and that’s when I discovered all the arp requests from that bogus MAC address (00:11:22:ab:cd:ee).

I am relatively sure that I have only one working DHCP server, the one built into the Cox box.

I have scoured net looking for clues and have found others whose networks report similar symptoms that mention that bogus MAC address, but none that have identified a cause or solution.

I am very good at following directions and will supply any other information as requested, if it is within my ability. I have these tools – Wireshark, XArp, a basic knowledge of the Administrative Command Prompt, and some LAN scanner software apps. But, I am by no means a network engineer or any kind of network expert. I am sure that I am what real network experts call "knows just enough to be dangerous" so please forgive me.

UPDATE - The craziness got worse after my original post, as the Cox Panoramic Gateway (Technicolor CGM4141) began to issue random ARP requests wherein it reported its OWN MAC address as the suspect 00:11:22:ab:cd:ee instead of the factory one. Also the behavior where it allowed ARP requests from IP addresses outside my network intensified. It was randomly reassigning MAC addresses to my devices, which began to look very much like a classic "Man-In-The-Middle" attack. I was beginning to sweat!

Once I caught it randomly changing its OWN MAC address, I called Cox support, who insisted that this was a problem for their "Complete Care Department" at a cost of $10 /mo, which they promptly signed me up for.

After explaining the problem to "Paul" he suggested that I perform a "hard" factory reset on the Gateway, which would wipe all my settings like SSID, passwords, and my DHCP address boundaries, which I could manually subsequently restore.

So, desperate to try for a solution, I pushed the reset button with a small paperclip, and waited about 12 minutes for the LED to turn solid white. I restored my critical settings (BTW, I could find no place to change my SSID and PASSWORD in the Gateway's GUI, or on the Cox Wi-Fi website. Turns out you HAVE to use their "APP" on a phone or tablet to do that.) and now it has been running for 2 hours with no glitches.

But, I spoke too soon, the Gateway is now resuming its former bad behavior, assigning "outside" MAC addresses to internal ARP requests.

8
  • Does the MAC address show up among the router's "connected Wi-Fi clients" list (if it has one)? Assuming that's the only Wi-Fi access point on the network.
    – user1686
    Aug 12, 2021 at 19:55
  • It's pretty common for virtual interfaces to get a "bogus" MAC address. With identical devices (e.g. the NAS), I suppose collisions can happen... If you have shell access to the Synology, start looking at network namespaces and virtual interfaces.
    – dirkt
    Aug 12, 2021 at 21:12
  • The router is very sparse with information. Cox believes it's all stuff we (users) don't need to know.
    – TommyGee
    Aug 12, 2021 at 23:30
  • The router is very sparse with information. Cox believes it's all stuff we (users) don't need to know. A recent Wireshark ARP packet sniff has now turned up something more disturbing. A device on the LAN (Home theater receiver) had its IP address changed from 192.168.0.177 to 169.254.243.15 for a period of time. A LanScan output listed that device's MAC with both IP addresses but only for a short time.
    – TommyGee
    Aug 12, 2021 at 23:36
  • To reply to User1686 - None of the bogus MAC addresses ever showed in the router's client lists, but did show in the Cisco managed switch clients, and the computer's command prompt "arp -a" reports.
    – TommyGee
    Aug 13, 2021 at 23:20

1 Answer 1

0

Well, after more than a week with a new cable internet Gateway, specifically a white case Technicolor CGM4331COM Rev 2.0 replacing the previous dark gray Technicolor CGM4141, all of the spurious ARP traffic and any instance of the bogus 00:11:22:ab:cd:ee MAC address is gone. Also, all of the ARP requests from IP addresses from outside the LAN are also gone.

ARP traffic has also lessened somewhat on the LAN averaging around 1000 packets of ARP traffic per hour, as opposed to almost twice that many before the replacement.

It is noteworthy that the old gateway failed in a very unusual manner, one not seen by the Cox second level “Total Care” technical support representatives. It was their experience that when these gateways fail, they take internet connectivity with them, sometimes sporadically and sometimes completely. In this case, the only symptom was the repeated generation of “Duplicate MAC Address” warnings from Wireshark and from my NAS servers, due to the random re-assignment of MAC addresses by the router function of this gateway.

Also of note is that there was some similar discussion on the internet of spurious MAC addresses from a Comcast Xfinity user, which is probably because Comcast uses the same series of Technicolor gateways for their service.

Lastly, the Cox support representative suggested that I visit a local Cox store in person to make the exchange of gateways, as their online tech support would, most likely ship me a “new” gateway on request, but that it would probably be the same Technicolor GCM4141 (gray) that had been refurbished.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.