Linksys Velop Changed it's Address By Itself

Warrenwood

Something weird happened last week. At my home I run AT&T Fiber, and a Linksys Velop mesh system (specifically the MX6200.) Velop is the main router and DCHP and I use IP pass through to get through the AT&T modem. Everything has operated well for a couple of months, then last Thursday, I lost connectivity to my Velop admin page, laser printer and NAS unit. My Windows 2025 server had a VM lose connectivity as well. The common denominator was that all these devices has static IP addresses in the 192.168.1.xxx range.

So after a bit of ipconfig release/renew, I found the Velop had changed its own IP address from 192.168.1.1 to 10.222.0.1. And of course, DHCP changed to 10.222.0.x as well. I was able to get into the Velop admin page and change it all back, but I’ve never seen this happen before.

A few more details:
AT&T gateway:

Address is 192.168.1.254
DCHP covers 192.168.1.120-125
IP pass through is configured for the Velop’s MAC address

Velop:

Address is 192.168.1.1
DCHP covers 192.168.51-99
All devices connect to this router, nothing connects directly to the AT&T gateway.

I’m guessing the Velop router through there was an address collision and changed it’s own network address, but I’ve never seen this happen before. Has anybody seen anything like this?

Thanks!

Somewhat-Reticent

Unless it didn’t change “by itself”, but had outside assistance …

HELLFIRE

Warrenwood So after a bit of ipconfig release/renew, I found the Velop had changed its own IP address from 192.168.1.1 to 10.222.0.1. And of course, DHCP changed to 10.222.0.x as well.

TL;DR : you got an unknown and/or rogue DHCP server(s).

Longer version : IF you know wireshark, and IF you can replicate the 192.168.x.x -> 10.222.x.x change on demand, look for what is OFFER’ing the wrong information and track down where it’s coming from.

The DHCP DORA process is pretty well described, but like anything else UDP, it’s what gets recieved first by the host.

I recall an anecdotal story from the DSLR days someone found out their smart refrigerator was the rogue DHCP server…

Regards

Warrenwood

HELLFIRE you got an unknown and/or rogue DHCP server(s).
Sigh… I don’t know Wireshark well (been 20 years since I got into the depths of networking) and it’s only happened once since moving from cable Internet to AT&T fiber. I think my odds of hitting Powerball will be better than duplicating the issue.

But your comment about two DHCP servers is giving me a direction to chase. I wonder if the AT&T gateway is the rogue? The AT&T gateway has DHCP turned on, but that’s to allow the Velop to get an address. I’ve verified they’re on different ranges, but maybe AT&T is playing shenanigans on me.

Thanks!

HELLFIRE

Warrenwood I wonder if the AT&T gateway is the rogue?

Possibly. Wireshark – or any similar packet capture software – would be the way to definitively demonstrate that.

ADDENDUM: Here’s Wireshark’s wiki on DHCP with sample captures – https://wiki.wireshark.org/DHCP If you capture the DORA traffic and saw the AT&T gateway and it’s MAC as the source of the DHCPOffer for the 10.222.0.x range, that’s definitive proof it’s doing SOMEthing screwy.

Leave to you where/how you want to go next…

Regards

Eskimo007

HELLFIRE Kind of reminds me of years ago when a company came out with the MOA PC (Itanium if memory serves) which we had in the QA lab, and when the lab NW accidentally got connected to the main production network, MS networking decided to have an “election” to determine which was the most powerful/suitable machine to be the PDC and the Itanium prototype became the defacto PDC. Aince it had no user names/password info in its registry, nobody could logon anywhere anymore (almost). Sheesh! Tht was one for the books. Then we figured out how to create a registry entry that would cause the real PDC to never give up its role no matter how good another windows machine coming online would be.

HELLFIRE

Eskimo007 Sheesh! Tht was one for the books.

Mine was a problem ticket sitting for a month saying no one had internet and wasn’t getting traction with anyone : us, local support, the ISP. I hit on the idea of throwing up wireshark… found out some contractor’s laptop was sending rogue DNS responses. Was VERY satisfying to close that problem ticket…

Regards