Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Bizarre IP in my LAN

    Scheduled Pinned Locked Moved DHCP and DNS
    15 Posts 3 Posters 1.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • M
      Modesty
      last edited by Modesty

      WOW

      I used Rougue Checker and found

      086c80fc-c477-4ea6-aad2-1758dfb29385-image.png

      4263e5a8-1ddc-4827-9bcb-de308c73715a-image.png

      Is the 169.254.5.254 on my PC? Its not on my pfSense box

      Any tip to help me one more step?

      Everything can be rebuilt!

      johnpozJ 1 Reply Last reply Reply Quote 0
      • AndyRHA
        AndyRH @johnpoz
        last edited by

        @johnpoz said in Bizarre IP in my LAN:

        or you could use nmap

        Nuts, did not think about that.

        o||||o
        7100-1u

        1 Reply Last reply Reply Quote 0
        • johnpozJ
          johnpoz LAYER 8 Global Moderator @Modesty
          last edited by

          @Modesty said in Bizarre IP in my LAN:

          169.254.5.254

          That is a link-local IPv4 address, also known as APIPA - windows will give itself that address when an interface is set for dhcp, but a dhcp server does not answer.. No you really shouldn't have that IP on your PC..

          What doe the output of ipconfig /all show?

          example

          Windows IP Configuration                                                                       
                                                                                                         
             Host Name . . . . . . . . . . . . : i9-win                                                  
             Primary Dns Suffix  . . . . . . . : home.arpa                                               
             Node Type . . . . . . . . . . . . : Broadcast                                               
             IP Routing Enabled. . . . . . . . : No                                                      
             WINS Proxy Enabled. . . . . . . . : No                                                      
             DNS Suffix Search List. . . . . . : home.arpa                                               
                                                                                                         
          Ethernet adapter Ethernet 2:                                                                   
                                                                                                         
             Connection-specific DNS Suffix  . :                                                         
             Description . . . . . . . . . . . : Realtek PCIe 5GbE Family Controller                     
             Physical Address. . . . . . . . . : 34-C8-D6-B4-01-55                                       
             DHCP Enabled. . . . . . . . . . . : No                                                      
             Autoconfiguration Enabled . . . . : Yes                                                     
             IPv4 Address. . . . . . . . . . . : 192.168.10.9(Preferred)                                 
             Subnet Mask . . . . . . . . . . . : 255.255.255.0                                           
             Default Gateway . . . . . . . . . :                                                         
             NetBIOS over Tcpip. . . . . . . . : Enabled                                                 
                                                                                                         
          Ethernet adapter Ethernet:                                                                     
                                                                                                         
             Connection-specific DNS Suffix  . : home.arpa                                               
             Description . . . . . . . . . . . : Killer E2600 Gigabit Ethernet Controller                
             Physical Address. . . . . . . . . : B0-4F-13-0B-FD-16                                       
             DHCP Enabled. . . . . . . . . . . : Yes                                                     
             Autoconfiguration Enabled . . . . : Yes                                                     
             IPv4 Address. . . . . . . . . . . : 192.168.9.100(Preferred)                                
             Subnet Mask . . . . . . . . . . . : 255.255.255.0                                           
             Lease Obtained. . . . . . . . . . : Saturday, November 9, 2024 12:35:04 PM                  
             Lease Expires . . . . . . . . . . : Sunday, November 17, 2024 12:35:03 PM                   
             Default Gateway . . . . . . . . . : 192.168.9.253                                           
             DHCP Server . . . . . . . . . . . : 192.168.9.253                                           
             DNS Servers . . . . . . . . . . . : 192.168.3.10                                            
             NetBIOS over Tcpip. . . . . . . . : Enabled                                                 
                                                                                                         
          Ethernet adapter vEthernet (WSL):                                                              
                                                                                                         
             Connection-specific DNS Suffix  . :                                                         
             Description . . . . . . . . . . . : Hyper-V Virtual Ethernet Adapter                        
             Physical Address. . . . . . . . . : 00-15-5D-AF-59-50                                       
             DHCP Enabled. . . . . . . . . . . : No                                                      
             Autoconfiguration Enabled . . . . : Yes                                                     
             Link-local IPv6 Address . . . . . : fe80::15f4:5c26:699:97d7%27(Preferred)                  
             IPv4 Address. . . . . . . . . . . : 172.29.64.1(Preferred)                                  
             Subnet Mask . . . . . . . . . . . : 255.255.240.0                                           
             Default Gateway . . . . . . . . . :                                                         
             DNS Servers . . . . . . . . . . . : fec0:0:0:ffff::1%1                                      
                                                 fec0:0:0:ffff::2%1                                      
                                                 fec0:0:0:ffff::3%1                                      
             NetBIOS over Tcpip. . . . . . . . : Enabled                                                 
          

          That 192.168.9.100 is my normal network connection, the 192.168.10.9 is a 5ge interface I have connected directly to my NAS with also a 5ge connection that I use only for transfer of files between my nas and pc. The 172.29.64.1 is interface used only for the WSL instance I run on my PC..

          An intelligent man is sometimes forced to be drunk to spend time with his fools
          If you get confused: Listen to the Music Play
          Please don't Chat/PM me for help, unless mod related
          SG-4860 24.11 | Lab VMs 2.8, 24.11

          johnpozJ 1 Reply Last reply Reply Quote 0
          • johnpozJ
            johnpoz LAYER 8 Global Moderator @johnpoz
            last edited by

            @johnpoz

            Keep in mind what L2 are those 192.168.10 showing up on - to detect if you have dhcp server you don't know about - you would need to be on that same L2 network

            What network are those .10 showing up on - your 2 your 4 or your 5?

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 24.11 | Lab VMs 2.8, 24.11

            M 1 Reply Last reply Reply Quote 0
            • M
              Modesty @johnpoz
              last edited by

              Hi, thanks for answer.

              @johnpoz said in Bizarre IP in my LAN:

              @johnpoz

              Keep in mind what L2 are those 192.168.10 showing up on - to detect if you have dhcp server you don't know about - you would need to be on that same L2 network

              That is may not be possible, I dont have a .10 network, how can I log in to it?
              I tried network VLAN_5_LEILIGHET, no ping response from 192.168.10.18 + .24

              What network are those .10 showing up on - your 2 your 4 or your 5?

              The .10 is only visible on unifi controller, not in DHCP leases on pfSense

              the .10 is to a sonos device, in a apartment I rent out.
              Can it be its ovn dhcp server?
              Can it be some issues due to 10 days ago my dhcp was on only192.168.10.0/24

              .2 is my lan, .4 and .5 is VLANs

              f2727833-2958-4187-b011-366eacbbe2c6-image.png
              b56938c8-5ce4-4580-afc5-71a0bf91d7a2-image.png

              Everything can be rebuilt!

              johnpozJ 1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator @Modesty
                last edited by johnpoz

                @Modesty said in Bizarre IP in my LAN:

                That is may not be possible, I dont have a .10 network

                You have a L2 they are showing up on if your seeing the traffic in pfsense.. You understand the difference between L2 and L3?

                Where exactly are you seeing that in pfsense - the firewall, if so what interface does the firewall log the traffic on?

                You can boot a client in the unifi controller

                Click on the client in the unifi controller and look at the little gear icon

                reconnect.jpg

                Can it be some issues due to 10 days ago my dhcp was on only192.168.10.0/24

                You mean you use to a hand out 192.168.10 addresses from pfsense dhcp? It could be the client not wanting to change its address.. Iot devices are not always that smart ;) Have seen iot devices once get an IP from dhcp never want to change it, because they never ask for dhcp again.. You have to like completely reset the device.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                M 1 Reply Last reply Reply Quote 0
                • M
                  Modesty @johnpoz
                  last edited by

                  Thanks @johnpoz Bizarre IP in my LAN:

                  You have a L2 they are showing up on if your seeing the traffic in pfsense.

                  As I wrote:
                  "The .10 is only visible on unifi controller, not in DHCP leases on pfSense."

                  I have done 36b34e5e-f01e-44e3-ba81-de74fb3726d1-image.png
                  Still goes back to .10, this is why I state bizarre ip in my LAN

                  I have not restarted the sonos, its in an apartment I dont have access to.

                  Everything can be rebuilt!

                  johnpozJ 1 Reply Last reply Reply Quote 0
                  • johnpozJ
                    johnpoz LAYER 8 Global Moderator @Modesty
                    last edited by

                    @Modesty said in Bizarre IP in my LAN:

                    "The .10 is only visible on unifi controller, not in DHCP leases on pfSense."

                    Did I say anything about dhcp leases?? So your not seeing any firewall traffic blocking these 192.168.10 address?

                    this is why I state bizarre ip in my LAN

                    So which one of these networks .2 .4 or .5 is your LAN in pfsense?

                    You say your only have .2 4 an 5.. Yet your pc also has a 192.168.88 address.

                    Maybe it would help if you actually draw up a picture of how you have your network setup..

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 24.11 | Lab VMs 2.8, 24.11

                    M 1 Reply Last reply Reply Quote 0
                    • M
                      Modesty @johnpoz
                      last edited by

                      @johnpoz said in Bizarre IP in my LAN:

                      Maybe it would help if you actually draw up a picture of how you have your network setup..

                      1d156f70-b244-4e69-9ddc-02d9dd670d29-image.png

                      This is not my expertice, so sorry if I'm not 100%

                      In pfSense box I dont se .10, only on unify controller.

                      So where does .10 come from?

                      You say your only have .2 4 an 5.. Yet your pc also has a 192.168.88 address.

                      I think this is on my PC, some service, maybe NordVPN, I dont know to be honest.

                      M

                      Everything can be rebuilt!

                      johnpozJ 1 Reply Last reply Reply Quote 0
                      • johnpozJ
                        johnpoz LAYER 8 Global Moderator @Modesty
                        last edited by johnpoz

                        @Modesty again to mention that these IOT devices sometimes will not give up an old IP.. You stated you use to run a 192.168.10 network.. So reset these sonos devices or log into them, put a 192.168.10 address on your device and change their IPs to what they should be for the network you have them on, your lan on 192.168.2?

                        Or just factory reset them. Or forget network, etc.

                        If you want to check if you have some rouge dhcp server, you would have to connect to whatever vlan/network these sonos are on - in your unifi controller what ssid are they connecting to, what network is that suppose to be currently?

                        edit: here I set my phone to use a IP that is not on my network.. And the unifi controller sees it.. If you had a rouge dhcp server you would think you would see more than these sonos devices on the different IP scheme.. But since its the sonos only, my guess would be at one time they had those IPs when you were running the 192.168.10 network, and they don't want to give it up - either they are set static on the device, or their iot stack is shit and they are not getting the new IP from your current dhcp server range..

                        phone.jpg

                        You will need to either login to them and fix the static, or reset them so they get a new dhcp IP.

                        I had a thermostat that was like this - pos! once it got a IP from dhcp it would never ask for dhcp again, it would just continue to use the IP it got originally.. I had to go on the thermostat and reset the whole network.. Then when I connected it got an IP on the current network, and set a reservation for it so it would never cuase a possible dupe IP issue because it wasn't renewing its lease.

                        edit2: a quick google found this about sonos

                        https://www.reddit.com/r/sonos/comments/193fmti/sonos_devices_dont_release_dhcp_assignments/

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 24.11 | Lab VMs 2.8, 24.11

                        M 1 Reply Last reply Reply Quote 0
                        • M
                          Modesty @johnpoz
                          last edited by

                          @johnpoz
                          Thanks, I did reset them and reinstalled them , now they behave like kids ;-)

                          Everything can be rebuilt!

                          johnpozJ 1 Reply Last reply Reply Quote 0
                          • johnpozJ
                            johnpoz LAYER 8 Global Moderator @Modesty
                            last edited by

                            @Modesty said in Bizarre IP in my LAN:

                            now they behave like kids ;-)

                            hahah - not sure how to take that, you mean they are working correctly or are they still acting up - hahah ;)

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 24.11 | Lab VMs 2.8, 24.11

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.