Linksys assigned IP to unknown DHCP client???

From: aladin (aladin168@hotmail.com)
Date: 11/16/02 

From: aladin168@hotmail.com (aladin)
Date: 15 Nov 2002 19:50:59 -0800

I have noticed that my DHCP clients table has been showing UNKNOWN
DHCP clients!!! I only have 2 computers using my cable modem, but on
the DHCP clients table, it showed weird IP addresses that are outside
of the DHCP IP range I assigned. The MAC address seems to be spoofed
too... Any exploits out there for this type of behavior?

It is on a Charter Comm cable modem. Could it be some type of "arp
poisoning" with some additional exploits?

Client Hostname IP Address MAC Address
         192.168.17.101 00-00-01-09-00-20
         192.170.17.101 20-02-03-89-10-00
        194.168.1.118 00-00-20-08-00-01
  ` 208.168.59.103 00-02-68-20-00-00
        192.168.169.105 01-02-6A-62-10-02
         192.170.17.106 20-20-21-20-01-01
        192.185.17.108 00-00-E4-00-00-80
        193.168.7.111 00-00-20-20-00-10
         200.168.17.110 01-00-14-02-11-20
  % 192.171.179.115 00-20-2A-02-00-00
  ? 192.168.1.123 00-20-22-40-02-12

I have a Linksys BEFSR11, the 1 port DSL/Cable Modem Router with
Firewall.

Firmware Version: 1.42.3, Jan 28 2002

I have a switch connected to the Linksys Router, and 2 PC connected to
my switch. 1 PC has Static IP and the other use DHCP.

I configured the DHCP as:
--------------------------
DHCP Server: Enable
Starting IP Address: 192.168.1.100
Number of DHCP Users: 50
Client Lease Time: 0 minutes (0 means one day)
 
DNS 1: 0.0.0.0
2: 0.0.0.0
3: 0.0.0.0
WINS: 0.0.0.0

---------------------

This is very weird. Anyone experiencing the same problem?

I plan to upgrade to firmware 1.43, but this has been happening since
1.3x and my current version 1.42.3.

Thanks,
/Kyle
Kyle Lai, CISSP, CISA, MCSE
Information Security Consultant
Kyle Lai Consulting
kyle@kylelai.com
www.kylelai.com

Relevant Pages
Quantcast