Posted: Fri Jun 14, 2019 7:07 Post subject: Duplicated many Mac addresses
I have a rental property using Technicolor VDSL modem router, TG588v. Several tenants are using about 20 wifi devices and 2 Ethernet connected PCs.
When tenants complain the internet got very slow, I could remotely logged in and I found the Technicolor's event log hundreds of these ARP conflict messages;
Code:
Warning Jun 8 22:00:19 ARP : conflict detected on interface LocalNetwork for
address 192.168.1.67, switch entry state to PROBING
Warning Jun 8 21:59:57 ARP : conflict detected on interface LocalNetwork for
address 192.168.1.64, switch entry state to PROBING
Warning Jun 8 21:59:44 ARP : conflict detected on interface LocalNetwork for
address 192.168.1.81, switch entry state to PROBING
Warning Jun 8 21:59:44 ARP : conflict detected on interface LocalNetwork for
address 192.168.1.73, switch entry state to PROBING
Warning Jun 8 21:59:44 ARP : conflict detected on interface LocalNetwork for
address 192.168.1.73, switch entry state to PROBING
Warning Jun 8 21:59:44 ARP : conflict detected on interface LocalNetwork for
address 192.168.1.73, switch entry state to PROBING
Warning Jun 8 21:59:44 ARP : conflict detected on interface LocalNetwork for
address 192.168.1.73, switch entry state to PROBING
Warning Jun 8 21:59:44 ARP : conflict detected on interface LocalNetwork for
address 192.168.1.73, switch entry state to PROBING
Warning Jun 8 21:59:44 ARP : conflict detected on interface LocalNetwork for
address 192.168.1.73, switch entry state to PROBING
After restarted the Technicolor became normal, but once or twice a day, the same problems happened.
I suspected the Technicolor's router OS is not stable,
so I decided to make Technicolor modem router to be VDSL bridge mode, then added Linksys WRT54G2 / GS2 DD-WRT v24-sp2 (08/07/10) micro - build 14896.
Today the same internet slowness happened, I remotely logged in then restarted DD-WRT router only, but it was still slow, and found strange things;
- Active clients has many duplicated Mac addresses,
5B:09:27:27:56:46 this is not vendor assigned Mac.
- Strange ip address, 169.254.124.235
After I restarted both Technicolor modem and DD-WRT router, then became normal.
I guess, one of my tenants has virus in the PC or device.
Any thoughts?
