Question Chasing a ghost...

[jk_1966]

Hello,
We have a problem from time to time in our net at work: Some offending IP (192.168.0.254) which causes problem to all the machines, in all floors. Then we concluded that the problem lies in our floor (5th). At first we thought that someone tries to plug a router (because of the special IP...) but that was not the case.
Now, about the net structure: We have the problem at the 5th floor (switch), which takes from another switch at the 1st floor.
So, when problem occurs our admin turns off both switches.
I installed MyLanViewer (https://www.mylanviewer.com/network-ip-scanner.html) on my machine where you can put an IP and send you a message when it sees it, but I am not sure if it will help...
Any ideas?

 

[kanewolf]

Hello,
We have a problem from time to time in our net at work: Some offending IP (192.168.0.254) which causes problem to all the machines, in all floors. Then we concluded that the problem lies in our floor (5th). At first we thought that someone tries to plug a router (because of the special IP...) but that was not the case.
Now, about the net structure: We have the problem at the 5th floor (switch), which takes from another switch at the 1st floor.
So, when problem occurs our admin turns off both switches.
I installed MyLanViewer (https://www.mylanviewer.com/network-ip-scanner.html) on my machine where you can put an IP and send you a message when it sees it, but I am not sure if it will help...
Any ideas?

Is the 192.168.0.x a subnet that is actually used or is this device completely rogue?
Are you a network admin for the network?
Are the switches fully managed switches ? If they are managed, are ALL unused ports disabled?

 

[jk_1966]

Thanks for answering,
1) 192.168.0.x subnet is not used
2) No, he is clueless. I'm a user trying to help
3) All switches are unmanaged
Forgot to tell you that in our rack there is a router that is connected to the switch of the 1st floor. It is used here only for the WiFi.
Correction: When we have problem (5th) about half of the people of the 1st floor have problem too.
Note: 1st floor's switch is an ancient Cisco

 

[bill001g]

It depends on what problems are happening. All it really takes is some idiot bringing his router in from home and plugging it into your network. It will start offering ip addresses via dhcp to client and break any machine that gets a IP from that router.

This has been a problem for a very long time and many commercial switches have features that restrict how DHCP is used.

Can you see the mac address of the offending device. ARP -a

Since this is not your network try adding some IP in that range as a secondary IP on the nic. You would add 192.168.0.50 for example. This is purely so you can attempt to communicate with this device. If it works you should be able to ping the IP.
You can then unplug cable by cable until the ping stops.

Nasty stuff like this is why when you get bigger you have managed switches. You could then log into the switch and see exactly which mac address is on what port. You can also use feature to prevent unauthorized equipment from being plugged into your network. Your company having clueless IT guys is a big part of the problem.

 

[Ralston18]

@jk_1966

And I will ask where you got "MyLanViewer"?

The link provided in Post #1 references a link "Outside of Facebook".

?

URL

= https://l.facebook.com/l.php?u=http...uk6qqI8eri5pN4rjXytTp4xAhRxMSNxBQdUF6TR-0fQYZ

A Google search for "MyLanViewer led to:

https://www.mylanviewer.com/how-to-see-who-is-connected-to-your-wireless-network.html

MyLanViewer not being helpful, accurate, or buggy. Or possibly even contributing to or being part of the problem.

Noted in the documentation that the app can be configured for automatic monitoring at startup and that the default IP address range is 192.168.0.1 to the afore mentioned 192.168.0.254.

Rescan frequency being 1 (one) minute.

Is MyLANViewer configured to launch (Task Manager > Startup) when your computer is booted?

If so, I suggest disabling MyLanViewer and determine if there are any changes with respect to the network performance and/or problems.

Just as a matter of elimination.

 

[jk_1966]

I scan from time to time from my desktop hoping to find it.
My colleague insists that it is a router plugged in and not an actual computer. Can you confirm that?

 

[bill001g]

There is no way to say for sure what it is but that IP is another common IP used by routers and if the router is using DHCP then it can kill you network. Read my above post maybe it was too long but it has some hint on finding a device like this.

It needs to be connected to the network long enough for your to find it though.

 

[Ralston18]

Does anyone, IT hopefully, have any sort of diagram showing all of the network devices (computers, printers, NAS, routers, switches, etc.) and their corresponding Ethernet connections between devices and floors?

Could the problem be a network loop?

If there is no diagram or network map then a map needs to be created.

Someone, IT and/or otherwise, needs to start tracing ethernet cables , devices, ports (by number) used, find device names, MAC's and IPs.

The network diagram likely to prove helpful when it comes to the above recommended troubleshooting via unplugging and replugging.

Helps with seeing the "big picture" and with being able to use a methodical troubleshooting process.