My MAC address shows up twice in DHCP list--why?

[jsteph]

Hi All,
In my router's dhcp client list (Linksys WRT 610 NV2, running DD-WRT), I see two IP addresses for my machine. One has the machine's host name listed, the other just an asterisk. Both seem to have leased at the same time. Can you tell me why this might be, and where I might start investigating to find the source?
Thanks,
--Jim

 

[VinceWhirlwind]

On your PC, do an IPconfig /all

 

[jsteph]

Vince,
Thanks, I did that, and remembered more that I hadn't mentioned at first:
I have a hardcoded IPv4 address, which doesn't show in the DHCP (for that reason), so there's actually 3 addresses for my machine.

Ipconfig/all shows the hardcoded one with (preferred) next to it for the Ethernet Local Connection, with the MAC I'm referring to in the router DHCP table.

There are no other ipv4 addresses in the output of ipconfig/all.

It shows a Toredo Tunnel and an MS Isatap--both with different physical addresses.

So the only thing showing under the MAC for my ethernet is the hardcoded address, yet DHCP is still showing two other ipv4 addresses with fresh leases.
--Jim

 

[VinceWhirlwind]

I can't make head or tail of that - your PC ethernet interface is configured with an IP address, therefore it is not emitting a DHCP request, so the DHCP server doesn't see one from it.

Do you have a wireless interface that's issuing a DHCP request?

I would have a look at the router's MAC-address table and ARP table to get a better picture of what devices are on your network.

 

[jsteph]

Vince,
No this machine has no wireless on it. The DHCP server however is apparently seeing and responding to requests from this MAC, which is the onboard ethernet port, the same one that the router shows under "active clients"; then below that is "DHCP clients", where I see that same MAC two more times with IP's different than the hardcoded one.

I had heard somewhere that either games or spyware may make a separate request for their own address on the same nic--is this a possibility? My son had used this machine, he's gone at school but he said he had some game on it, but there are no games open (though I suppose they may have a service running).
--Jim

 

[VinceWhirlwind]

Maybe your PC is configured to use DHCP to get DNS?

What does your ipconfig /all say, exactly?

 

[jsteph]

Vince,
Below is Ipconfig/all...I don't have a url to post a screenshot of the router--but the MAC ending in BB-18 shows up with the hardcoded 192.168.1.120 address in the "Active Clients" section--sometimes with the hostname "AlexWin7", sometimes with an asterisk. Then below that in the "DHCP Clients" section it shows up--if the above section had an asterisk then the hostname will show up in the DHCP clients section, and vice-versa. Also, at times I've seen the BB-18 Mac show up multiple times in the DHCP clients section, but it'll only show up once using the Hostname (not sure if that means anything).

Thanks for your help,
--Jim

Microsoft Windows [Version 6.1.7601]
Copyright (c) 2009 Microsoft Corporation.  All rights reserved.

C:\Users\Alex>ipconfig/all

Windows IP Configuration

   Host Name . . . . . . . . . . . . : AlexWin7
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : Yes
   WINS Proxy Enabled. . . . . . . . : No

Ethernet adapter Local Area Connection:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) 82567V-2 Gigabit Network Connect
ion
   Physical Address. . . . . . . . . : xx-xx-xx-xx-BB-18
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::119a:43f2:a991:4f10%10(Preferred)
   IPv4 Address. . . . . . . . . . . : 192.168.1.120(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.0
   Default Gateway . . . . . . . . . : fe80::224:1ff:fe67:1127%10
                                       192.168.1.1
   DNS Servers . . . . . . . . . . . : 4.2.2.2
                                       4.2.2.3
                                       192.168.1.1
   NetBIOS over Tcpip. . . . . . . . : Enabled

Tunnel adapter isatap.{C971AA9B-367E-4A0E-9A57-66336948F351}:

   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Microsoft ISATAP Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes

Tunnel adapter Local Area Connection* 9:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2001:0:9d38:6ab8:24f8:1715:bad0:9bd7(Pref
erred)
   Link-local IPv6 Address . . . . . : fe80::24f8:1715:bad0:9bd7%12(Preferred)
   Default Gateway . . . . . . . . . : ::
   NetBIOS over Tcpip. . . . . . . . : Disabled

C:\Users\Alex>

 

[jsteph]

...I should clarify again that when the BB-18 MAC shows up in the "DHCP Clients" section of the router, that is shows up with a *different* IP address than shown in "Active Clients" (which is the hardcoded IP). It has shown up with at least two different IP's in the DHCP section, and DHCP is OFF for this interface.
--Jim

 

[VinceWhirlwind]

Well, it isn't your OS that's making a DHCP request - must be one of your applications that you have running.

Interesting that you have "IP Routing enabled". I wonder why that's set like that?

On another note, I got sick of seeing all this IPv6 crud in there on mine - as I don't know whether my internet router has any capacity for securing me in IPv6, I went into the interface and disabled it.

 

[jsteph]

Vince,
I never noticed the IP Routing Enabled before...that's a curious thing--I checked my other machines and they don't have that enabled so yes--some app must've set that. I will disable it and see what breaks and go from there. Thanks very much!
--Jim