1

I want my network to handle only static addresses. Consequently i turned the DHCP server off on my Edge router. The problem is that if someone tries to connect with automatically obtaining parameters, he gets everything (ip, net mask,gateway,...).
Since the DHCP server is inactive, it shouldn't be possible, should it? Can anyone help me in preventing automatically giving someone connexion parameters? i don't want any dynamic addressing on my network (restricted access)
By the way this is my router model :Ubiquiti EdgeMax EdgeRouter Lite ERLite-3 512MB Memory 3 Ethernet Ports Router

  • 2
    please edit to include at least the model of your router. Also see our NE Q checklist – Craig Constantine Aug 5 '15 at 11:41
  • You may be running DHCP on a server. – Chris Zog Aug 6 '15 at 1:52
2
  1. Killing DHCP does not make a network secure (or "restricted") against people connecting to it. Look at something like 802.1X and Remote Authentication Dial In User Service RADIUS for that application. It's trivial for an attacker with physical access to connect to the network, gain the general parameters by examination, and assign themselves an address.
  2. You evidently have more than one DHCP server on the network, if you turned one off and one is still running.
| improve this answer | |
  • Thank you i will check 802.1X and RADIUS. Concerning your second remark, I only created one DHCP server (that i turned off later) when i was configuring the router (model : Ubiquiti EdgeMax EdgeRouter Lite ERLite-3 512MB Memory 3 Ethernet Ports Router ). Even on the GUI of the router i can see : 1 DHCP server and it's off. – Andriniaina Andy Nkili Meyong Aug 5 '15 at 13:59
  • So something else on the network is offering DHCP. It's not magic. – Ecnerwal Aug 5 '15 at 14:12
  • Do you know a way to determine what else is offering DHPC on the network? – Andriniaina Andy Nkili Meyong Aug 5 '15 at 14:47
  • 1
    You can take a packet trace of DHCP transaction (lease renewal?) and inspect the MAC address. Copy the first 3 octets of the MAC address and paste them to the website listed below. That will tell you the manufacturer and should give some clue what it is - coffer.com/mac_find – stephen muth Aug 5 '15 at 21:41
  • You can also proceed by physical isolation - if you plug in a computer looking for DHCP to the router with nothing else connected, it should "get" a self-assigned address and not be able to connect to the internet, if the router's DHCP server is off. Then you plug things in and observe at what point the test computer gets DHCP service, and then you follow the path of the connected wire (easy on small networks, harder on large ones.) The default answer around here is probably "use wireshark" but since I don't actually do that at present, I'll let you decide if it's the answer for you. – Ecnerwal Aug 5 '15 at 22:17
1

on a windows machine, in command prompt

ipconfig /all

will give you the IP address of the DHCP server that gave you the dhcp lease.

Also most modern operating systems support Automatic Private IP addressing ("APIPA") that will give a network config if there's no DHCP server.

If the IP address you get begin with 169.254. then it's an APIPA address and there's no rogue DHCP server.

| improve this answer | |
1

I have had lots of trouble with the EdgeRouter DHCP server. It is pretty half baked, and does things like this to me often. I'd recommend completely deleting the DHCP server and checking your config to ensure its removal. After that, completely reboot your EdgeRouter.

If this doesn't fix it, try plugging a device directly onto the LAN of your EdgeRouter. If you still get a valid DHCP address, you should upgrade to the latest firmware, and restore to factory defaults. If you don't get an address when plugged straight into the LAN, you have another DHCP server on your network.

| improve this answer | |
1

I see that you prefer to use EdgeRouter, but such case I would handle with Mikrotik where you can tell DHCP server to automatically register clients also in ARP table (option "Add ARP for leases" in DHCP setup - see http://mikrotik-learning.blogspot.com/2011/11/mikrotik-blocking-unleased-dhcp-ip.html) and use reply-only option for ARP on the network interface towards client and use switches where I would configure either dhcp snooping or hard port limit of 1 mac per port with long history. This way it would be way harder to do anything.

Attacker would need to find some valid mac/ip combination and would need unused ports to register with faked mac and faked ip.

| improve this answer | |
  • Nice idea. i agree Mikrotik would be more convenient (even for some other problems i deal with like handling queue,etc) but the thing is my edge router is brand new and i can't afford to buy an other one just because it would be easier to deal with this task (blocking people from getting automatically connected to my LAN). I'm going to figured it out on my Edge router.Thanks by the way. – Andriniaina Andy Nkili Meyong Aug 7 '15 at 13:17
  • I am also active on vendor official forum. They do listen to users. Maybe they already have something similar or can do it soon. – Tomaž Aug 7 '15 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.