Unknown Host Trying to Register with DHCP

Fahrenhe1t

Hi, I have an unknown host hammering my DHCP server trying to request an IP. I have Static ARP table enabled (and the host's MAC is not entered in my DHCP server static mappings), so it can't receive an IP. However, that's not stopping it from requesting an IP every few milliseconds.

I looked the MAC up on a lookup site and it says it's from ARRIS Inc. They're a cable modem manufacturer among other things, but my cable modem is by Netgear. It appears to be coming through my Wifi access point :(. Short of granting it an IP and trying to scan it's ports, how can I figure out what\where this is? Thanks!

jahonix

ARRIS is doing set-top boxes for satellite and cable as well. And xDSL voice gateways and such stuff…
If you have a managed switch you can try to find the MAC in the ARP table and see which port it hangs on.

Turn off WiFi temporarily and see if it still requests an address.

Fahrenhe1t

Good idea. I disabled wifi and I stopped seeing the machine in the logs. I went ahead and changed the SSID and password just to be safe.

KeyserSöze

@Fahrenhe1t:

Good idea. I disabled wifi and I stopped seeing the machine in the logs. I went ahead and changed the SSID and password just to be safe.

Did you have an open/unencrypted WiFi network/SSID that you were broadcasting?