# Duplicate DHCP



## rgupta52 (May 7, 2011)

Hi,

I am having an issue in my office. We run VOIP phones that takes IP from dhcp and boots via ftp. Now whats happening is that from yesterday onwards the phones are not booting up at all. They are just stopped at "*Waiting For Network To Initialize*." This happens when the phones do not get IP from dhcp server. 

So I logged in dhcp server and went through the logs. I was shocked to found this-

May 6 09:30:12 layer2 dhcpd: DHCPREQUEST for 192.168.1.5 (192.168.1.1) from 00:04:f2:1b:4a:11 via eth0: wrong network.
May 6 09:30:16 layer2 dhcpd: DHCPREQUEST for 192.168.1.14 (192.168.1.1) from 00:04:f2:17:e8:f9 via eth0: wrong network.
May 6 09:30:16 layer2 dhcpd: DHCPNAK on 192.168.1.14 to 00:04:f2:17:e8:f9 via eth0
May 6 09:30:17 layer2 dhcpd: DHCPREQUEST for 192.168.1.27 (192.168.1.1) from 00:04:f2:19:5a:0b via eth0: wrong network.
May 6 09:30:17 layer2 dhcpd: DHCPREQUEST for 192.168.1.19 (192.168.1.1) from 00:04:f2:1b:45:f7 via eth0: wrong network.
May 6 09:30:17 layer2 dhcpd: DHCPNAK on 192.168.1.19 to 00:04:f2:1b:45:f7 via eth0
May 6 09:30:18 layer2 dhcpd: DHCPREQUEST for 192.168.1.5 (192.168.1.1) from 00:04:f2:1b:4a:11 via eth0: wrong network.
May 6 09:30:20 layer2 dhcpd: DHCPREQUEST for 192.168.1.19 (192.168.1.1) from 00:04:f2:1b:45:f7 via eth0: wrong network.
May 6 09:30:20 layer2 dhcpd: DHCPNAK on 192.168.1.19 to 00:04:f2:1b:45:f7 via eth0
May 6 09:30:23 layer2 dhcpd: DHCPREQUEST for 192.168.1.14 (192.168.1.1) from 00:04:f2:17:e8:f9 via eth0: wrong network.
May 6 09:30:23 layer2 dhcpd: DHCPNAK on 192.168.1.14 to 00:04:f2:17:e8:f9 via eth0
May 6 09:30:24 layer2 dhcpd: DHCPREQUEST for 192.168.1.19 (192.168.1.1) from 00:04:f2:1b:45:f7 via eth0: wrong network.
May 6 09:30:24 layer2 dhcpd: DHCPNAK on 192.168.1.19 to 00:04:f2:1b:45:f7 via eth0
May 6 09:30:27 layer2 dhcpd: DHCPREQUEST for 192.168.1.19 (192.168.1.1) from 00:04:f2:1b:45:f7 via eth0: wrong network.
May 6 09:30:27 layer2 dhcpd: DHCPNAK on 192.168.1.19 to 00:04:f2:1b:45:f7 via eth0
May 6 09:30:28 layer2 dhcpd: DHCPREQUEST for 192.168.1.27 (192.168.1.1) from 00:04:f2:19:5a:0b via eth0: wrong network.
May 6 09:30:28 layer2 dhcpd: DHCPREQUEST for 192.168.1.5 (192.168.1.1) from 00:04:f2:1b:4a:11 via eth0: wrong network.
May 6 09:30:31 layer2 dhcpd: DHCPREQUEST for 192.168.1.27 (192.168.1.1) from 00:04:f2:19:5a:0b via eth0: wrong network.

Our dhcp server's IP is 10.1.21.1 and the Polycom phones have Ip in 32.xx series.

But the log reveals that there is another dhcp running which is offering 192.168.x.x IP to all phones instead of the actual dhcp runs that offers 10.1.32.xx.

Unfortunately, we do not use 192.168.x.x in our office and I couldn't find any server running with the IP 192.168.1.1. However, I am able to ping 192.168.1.1. I also tried to scan this IP to know the type of device for any clue but nmap shows that the host is down.

When i tried to tracepath 192.168.1.1, I found this -

1: administrator-desktop 0.081ms pmtu 1500
1: 10.1.21.1 0.873ms 
1: 10.1.21.1 0.844ms 
2: 10.1.12.2 1.185ms asymm 1 
3: 59.165.45.17.man-static.vsnl.net.in 2.148ms asymm 2 
4: 172.31.224.5 2.185ms asymm 3 
5: 172.31.76.2 1.906ms asymm 4 
6: no reply 
7: no reply 
8: no reply 
9: no reply 
10: no reply 
11: no reply 
12: no reply 

I am just unable to figure out whats going on and from where the hell this IP has come and processing dhcp requests.

I want to know how to figure it out what kind of device is that? Is it a managed switch, router.... etc.

Please help.


----------



## Wand3r3r (Sep 17, 2010)

someone brought their home wireless router in and hooked it up to the network.

You have to change your ip to the 192.x.x.x range to run the tracepath

Just look for a wireless router in the facility connected to your lan via one of its lan ports.


----------

