Duplicated many Mac addresses

Post new topic   Reply to topic    DD-WRT Forum Forum Index -> General Questions
Author Message
sn20202020
DD-WRT Novice


Joined: 13 Jun 2009
Posts: 5

PostPosted: Fri Jun 14, 2019 7:07    Post subject: Duplicated many Mac addresses Reply with quote
I have a rental property using Technicolor VDSL modem router, TG588v. Several tenants are using about 20 wifi devices and 2 Ethernet connected PCs.

When tenants complain the internet got very slow, I could remotely logged in and I found the Technicolor's event log hundreds of these ARP conflict messages;
Code:

Warning    Jun 8 22:00:19   ARP : conflict detected on interface LocalNetwork for

address 192.168.1.67, switch entry state to PROBING
Warning    Jun 8 21:59:57   ARP : conflict detected on interface LocalNetwork for

address 192.168.1.64, switch entry state to PROBING
Warning    Jun 8 21:59:44   ARP : conflict detected on interface LocalNetwork for

address 192.168.1.81, switch entry state to PROBING
Warning    Jun 8 21:59:44   ARP : conflict detected on interface LocalNetwork for

address 192.168.1.73, switch entry state to PROBING
Warning    Jun 8 21:59:44   ARP : conflict detected on interface LocalNetwork for

address 192.168.1.73, switch entry state to PROBING
Warning    Jun 8 21:59:44   ARP : conflict detected on interface LocalNetwork for

address 192.168.1.73, switch entry state to PROBING
Warning    Jun 8 21:59:44   ARP : conflict detected on interface LocalNetwork for

address 192.168.1.73, switch entry state to PROBING
Warning    Jun 8 21:59:44   ARP : conflict detected on interface LocalNetwork for

address 192.168.1.73, switch entry state to PROBING
Warning    Jun 8 21:59:44   ARP : conflict detected on interface LocalNetwork for

address 192.168.1.73, switch entry state to PROBING
   



After restarted the Technicolor became normal, but once or twice a day, the same problems happened.

I suspected the Technicolor's router OS is not stable,
so I decided to make Technicolor modem router to be VDSL bridge mode, then added Linksys WRT54G2 / GS2 DD-WRT v24-sp2 (08/07/10) micro - build 14896.

Today the same internet slowness happened, I remotely logged in then restarted DD-WRT router only, but it was still slow, and found strange things;

- Active clients has many duplicated Mac addresses,
5B:09:27:27:56:46 this is not vendor assigned Mac.
- Strange ip address, 169.254.124.235

After I restarted both Technicolor modem and DD-WRT router, then became normal.

I guess, one of my tenants has virus in the PC or device.
Any thoughts?



0technicolor.jpg
 Description:
 Filesize:  346.67 KB
 Viewed:  534 Time(s)

0technicolor.jpg



ddwrt.jpg
 Description:
 Filesize:  376.27 KB
 Viewed:  534 Time(s)

ddwrt.jpg


Sponsor
Wildlion
DD-WRT Guru


Joined: 24 May 2016
Posts: 759

PostPosted: Fri Jun 14, 2019 13:11    Post subject: Reply with quote
First thing that I can tell you is the 169.254.0.0/16 is a link-local address, that is a self assigned address due to not reaching the dhcp server.

I am almost thinking that someone has set up a wireless router to bridge or act as an access point, or booster but has not configured it correctly.
sn20202020
DD-WRT Novice


Joined: 13 Jun 2009
Posts: 5

PostPosted: Fri Jun 14, 2019 17:45    Post subject: Reply with quote
Further investigation, I found something are connecting to the router

- with the unknown/random Mac addresses
- with several random "STATIC" IP addresses which are already assigned by the other DHCP devices.

Therefore the ip/Mac conflictions made the problem.

Now how can I find the device or solve this happening.
egc
DD-WRT Guru


Joined: 18 Mar 2014
Posts: 5914
Location: Netherlands

PostPosted: Sat Jun 15, 2019 9:03    Post subject: Reply with quote
Do you have a honeywell evo home system or the likes?

If so check that

_________________
Routers:Netgear R7800, Netgear R6400v1, Netgear R6400v2, Linksys EA6900 (XvortexCFE), Linksys E2000 (converted WRT320N), WRT54GS v1.
OpenVPN Policy Based Routing guide: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=321686
Install guide R6400v2:http://forum.dd-wrt.com/phpBB2/viewtopic.php?t=316399
OpenVPN Server Setup:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=318795
Install guide R7800: https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=320614
Wireguard server setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?p=1183135
Wireguard client setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324624
Wireguard Advanced setup guide:https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324787
Forum Guide Lines (important read):https://forum.dd-wrt.com/phpBB2/viewtopic.php?t=324087
Display posts from previous:    Page 1 of 1
Post new topic   Reply to topic    DD-WRT Forum Forum Index -> General Questions All times are GMT

Navigation

 
Jump to:  
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum
You can attach files in this forum
You can download files in this forum