• March 28, 2024, 06:42:11 AM
  • Welcome, Guest
Please login or register.

Login with username, password and session length
Advanced search  

News:

This Forum Beta is ONLY for registered owners of D-Link products in the USA for which we have created boards at this time.

Author Topic: My DSP 215 is a rogue DHCP/DNS server  (Read 10074 times)

Kutalon

  • Level 1 Member
  • *
  • Posts: 5
My DSP 215 is a rogue DHCP/DNS server
« on: September 11, 2018, 10:14:31 AM »

I was searching my network for a rogue DHCP server because devices that booted before my router had IP from 192.168.0.x range while it should be 192.168.1.x.
After a lot of unplugging devices I found out that this is one of those DSP 215 smart plugs.   :o
How the hell is it possible and what can I do about it? Is ot possible that someone modified firmware to access my network?
firmware v2.22
« Last Edit: September 11, 2018, 10:17:41 AM by Kutalon »
Logged

FurryNutz

  • Poweruser
  •   ▲
    ▲ ▲
  • *****
  • Posts: 49923
  • D-Link Global Forum Moderator
    • Router Troubleshooting
Re: My DSP 215 is a rogue DHCP/DNS server
« Reply #1 on: September 11, 2018, 10:28:35 AM »

Have you factory reset the DSP and then set up from scratch and reconnect it to your existing network? It should maintain its connect to the network and use the IP address string it gets from the main host router?
What is the mfr and model# of the main host router your using?
Logged
Cable: 1Gb/50Mb>NetGear CM1200>DIR-882>HP 24pt Gb Switch. COVR-1202/2202/3902,DIR-2660/80,3xDGL-4500s,DIR-LX1870,857,835,827,815,890L,880L,868L,836L,810L,685,657,3x655s,645,628,601,DNR-202L,DNS-345,DCS-933L,936L,960L and 8000LH.

Kutalon

  • Level 1 Member
  • *
  • Posts: 5
Re: My DSP 215 is a rogue DHCP/DNS server
« Reply #2 on: September 24, 2018, 01:30:26 PM »

It is getting IP adress from router and work just fine but before router boots up it is working as DHCP server screwing up half of my network. Today this situation happened again and I unplugged second (and the last) one. I will power cycle my home tomorrow and check if it solved the issue.
Logged

GreenBay42

  • Administrator
  • Level 11 Member
  • *
  • Posts: 2752
Re: My DSP 215 is a rogue DHCP/DNS server
« Reply #3 on: September 25, 2018, 06:40:30 AM »

I do not see how it is possible the DSP is issuing IPs to devices on your network. It is a client. Are only wireless devices getting 192.168.0.x? Do you have any other wireless routers, extenders, or access points? Have they ever connected to a neighbor's network?

If Ethernet devices are getting 192.168.0.x then you have another router or server with DHCP enabled.

If there is some kind of rogue firmware on the DSP you need to reset it immediately and setup from scratch. Download the latest dlink firmware and reflash it.

Go here for instructions on manually flashing firmware --> http://forums.dlink.com/index.php?topic=73672.0
Logged

Kutalon

  • Level 1 Member
  • *
  • Posts: 5
Re: My DSP 215 is a rogue DHCP/DNS server
« Reply #4 on: September 26, 2018, 07:21:08 AM »

I do not know how is it possible either. Every device is getting IP even wired ones. There is no other device with DHCP server.
Unplugging second DSP W215 resolved the issue- after power outage devices connected to my APs but without IP addresses.
What was also leading to W215 was the IP address of DHCP server: 192.168.0.60.

What might have happened:
DSP W215 connects to WiFi
there is no DHCP sever in network yet (because it is still booting up)
DSP  starts to give IP addresses
router boots up and  DSP W215 shut down DHCP server

AP Ubiquiti AC LR
Router Ubiquiti Edge Router X SFP
Logged

GreenBay42

  • Administrator
  • Level 11 Member
  • *
  • Posts: 2752
Re: My DSP 215 is a rogue DHCP/DNS server
« Reply #5 on: September 26, 2018, 07:50:39 AM »

There is just no way the DSP can act as a DHCP server and give out IP addresses being a client. How can it give IPs to your wired clients? So strange.

Did you reset it or reflash the firmware? if someone hacked it this will fix it.

Make sure your AP does not have DHCP enabled.

Do your clients get this IP address when the router is off?

What is the gateway IP address of your clients when getting 192.168.0.x? That should be the server IP issuing the IPs.
Logged

Kutalon

  • Level 1 Member
  • *
  • Posts: 5
Re: My DSP 215 is a rogue DHCP/DNS server
« Reply #6 on: September 26, 2018, 01:23:51 PM »

I will reflash it later when I will have some time and check it.
I only get those IPs when the router is off or booting and DHCP server, DNS server and gateway IP is 192.168.0.60.
When I was pinging this IP and unplugging devices it lead me to DSP (first time to one of them and second time I got this problem I just went straight for the second one and there was no other DHCP server after that)

Unplugged the router just now and plugged DSPs.
then I ordered some devices to reconnect to the wifi and... they received 192.168.0.x IP
Even my PC after ipconfig/release renew received IP from it. IP adress leased from DSP over WiFi to AP and then to switch and to wired devices.
I used arp-a to check mac address of whatever is on 192.168.0.60 and it matches the sticker on DSP

arp
https://ibb.co/fFpy6p
PC internet config
https://ibb.co/dTL5mp
UniFi controller
https://ibb.co/cLfhXU



« Last Edit: September 26, 2018, 01:27:02 PM by Kutalon »
Logged

GreenBay42

  • Administrator
  • Level 11 Member
  • *
  • Posts: 2752
Re: My DSP 215 is a rogue DHCP/DNS server
« Reply #7 on: September 26, 2018, 01:51:15 PM »

So your wireless devices are connecting to the AP then to a switch then to the controller?

What switch do you have?  Is it a managed switch?

With the DSP plugged in, can you go to http://192.168.0.60? What comes up?

Does the DSP perform normally when on?

It sounds like the AP or the switch (if managed) is issuing IPs BUT since the gateway/MAC is pointing to the DSP something strange is going on to say the least.

Definitely re-flash the firmware as soon as you can.

Logged

Kutalon

  • Level 1 Member
  • *
  • Posts: 5
Re: My DSP 215 is a rogue DHCP/DNS server
« Reply #8 on: September 26, 2018, 02:04:59 PM »

What switch do you have?  Is it a managed switch?
unmanaged
With the DSP plugged in, can you go to http://192.168.0.60? What comes up?
just factory reseted them
Does the DSP perform normally when on?
yes, when router is up it just get it's own IP and work like nothing happened.

But I have a problem, I connect to DSP, go to 192.168.0.60, login with Admin and PIN from sticker, and all I have is some information about device but no option to upload firmware.
IE and Firefox
Firmware External Version: V2.22
Firmware Internal Version: V2.22b05
Date: Wed, 3 Feb 2016
Checksum: 0x06CDB68D
2.4GHz regulation domain: EU
1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13
Firmware Query: http://wrpd.dlink.com/router/firmware/query.aspx?model=DSP-W215_Bx_Default_FW_0222_C412F5EDD545
LAN MAC:
Kernel: 2.6.31, B0015, Date=Tue, 1 Dec, 2015
Apps: 1.1, B0141, Date=Wed, 03 Feb, 2016
WLAN Driver: AR9531, 10.2-00082-4, B0012, Date=Fri, 15 Jan, 2016
2.4GHz WLAN MAC 0:
2.4GHz SSID: DSP-Dxxx
Factory Default: 1
DCH_ID: xxx

Nothing more
« Last Edit: September 26, 2018, 02:07:26 PM by Kutalon »
Logged