change in ip for users

[suthomas1]

Hello All,

We had a strange problem few weeks back. One of our sites(about 15 users) started getting IP in a different private range that what is normally being used by dhcp server via the routers.

Disconnecting the cisco phones (users are connected via phones), helped to get away from this.

Can people give some ideas on how to identify what could be causing this. The subnet we use for users/phones is 10.58.0.x , but the users were getting ip from 172.31.x.x range.

[Georg Pauwen]

Hello,

could be a rogue DHCP server connected somewhere...can you give an indication what your network looks like ? Is a router being used as DHCP server ?

[suthomas1]

Thanks for the reply.

Router ----> Switch -----> Users

Router has subinterface that links to user subnet on layer 2 switch.

DHCP is on seperate dhcp servers. Helper addresses are configured on the router for forwarding.

I tried tracing the ip address (on different subnet) that users got on one of the times, but wasn't able to get much out it.