223.1.1.2 acting as DHCP server

[Guest]

Sometimes DHCP clients are unable to obtain IP addresses from DHCP server.
Running netmon indicates 223.1.1.2 was responding to DHCP requests instead of
my DHCP server. The phantom DHCP server, 223.1.1.2 has been able to assign an
IP of 223.1.1.28 to one client. Has anybody seen this problem? Pls. help!!!

 

[Lanwench [MVP - Exchange]]

Sometimes DHCP clients are unable to obtain IP addresses from DHCP
server. Running netmon indicates 223.1.1.2 was responding to DHCP
requests instead of my DHCP server. The phantom DHCP server,
223.1.1.2 has been able to assign an IP of 223.1.1.28 to one client.
Has anybody seen this problem? Pls. help!!!

Can you ping that DHCP server IP?
What's your network setup? Are you using public IP addresses on your LAN for
some reason?

 

[Steve Riley [MSFT]]

That's odd. Network 223 is reserved by IANA and shouldn't normally be used.
Are you using that network number? Where are you seeing this traffic from?
Is it coming in from the Internet? Your network firewall really shouldn't
be allowing DHCP to come in from the Internet.

Steve Riley
(e-mail address removed)

 

[Guest]

No I'm using NAT. I can't ping that dhcp server. I have a class c and don't
use that IP address anywhere on my network. Pls. help!!!

 

[Guest]

I'm not using the 223 number at all. I'm using NAT on a class C network. I
can find the associated MAC address on my network switch but can't locate
what that device is.

 

[Jetro]

It can be Trojan. Look up MAC address in Netmon and trace it down.

 

[Doug Sherman [MVP]]

Don't know what it means - but apparently 223.1.1.x is a common network
address used as an example for how DHCP works. If you do a Google search on
'DHCP 223.1.1.2', you'll find about a 100 documents mostly at colleges all
using this address as an example in various networking guides.

Doug Sherman
MCSE Win2k/NT4.0, MCSA, MCP+I, MVP

Sometimes DHCP clients are unable to obtain IP addresses from DHCP server.
Running netmon indicates 223.1.1.2 was responding to DHCP requests instead of
my DHCP server. The phantom DHCP server, 223.1.1.2 has been able to assign an
IP of 223.1.1.28 to one client. Has anybody seen this problem? Pls.

help!!!

 

[Herb Martin]

How many nodes on your network (generally)?

That DHCP server must be within the BROADCAST
domain and so should be fairly easy to locate the
rogue.

You would not automatically be able to ping it
if you (and it) didn't have routes between your
and it's net range -- this is true even if it were
on your cable as it must be.

It's either a true rogue or someone of you put up a
DHCP server and forgot it.

Your broadcast domain will not cross any routers
unless you have enabled BootP forwarding or
the equivalent on your routers.