Member Avatar for DammyDani

Hello, I'm Dammy. Theres a problem i've been battling with for the past few days and i was hoping someone could help me out. Whenever i connect a particular acer laptop to the internet at work via the wireless, internet access is lost after a period that ranges from 30 minutes to 1 hour and i have to reboot the VSAT modem to restore internet connectivity. This cycle of rebooting the vsat modem to restore internet access goes on and on until the problematic laptop is powered off.

Initially i thought the problem was with the modem since i always had to restart it, but i noticed that if i didnt take that laptop to work, internet access stayed up the whole day.

The acer laptop is enabled for DHCP and connects to a cisco wireless acess point that is connected to a cisco 2960 series switch which is in turn connected to the VSAT modem.

Looking forward to your reply.
Thanks a mil

  • 3 Contributors
  • 6 Replies
  • 2K Views
  • 5 Days Discussion Span
  • Latest Post Latest Post by sknake

Dani AI

Generated

Nice catch, . Given that the outage happened over both Wi‑Fi and Ethernet and cleared only when the VSAT edge was rebooted, this smells like a single host acting as a rogue gateway/DHCP server or spewing ARP replies. That would blackhole traffic or poison the VSAT’s ARP table until a reboot flushes it. Your combo fix (malware cleanup + enabling DHCP snooping) fits that pattern. Windows Internet Connection Sharing (ICS) or malware can silently enable DHCP and NAT on a laptop, exactly the kind of thing was aiming to surface with a capture.

If this pops up again, validate fast:

  • Packet capture on the Acer as suggested; use display filters like bootp (DHCP) and arp. Look for DHCP Offers coming from the laptop’s MAC, or gratuitous ARP claiming the gateway IP.

  • On Windows, check that ICS/bridging is off. In ncpa.cpl, open the adapter Properties > Sharing and uncheck sharing. Or, from an elevated cmd:

    sc query SharedAccess
sc stop SharedAccess
sc config SharedAccess start= disabled

    Also run ipconfig /all and confirm the laptop is not advertising itself as DHCP or default gateway.

Hardening tips for your Catalyst 2960 so one bad client cannot take down the site (adjust VLAN/ports as needed and trust only the true uplink):

! Global
ip dhcp snooping
ip dhcp snooping vlan 1
ip arp inspection vlan 1

! Uplink to VSAT/gateway
interface FastEthernet0/24
 description Uplink to VSAT/gateway
 ip dhcp snooping trust
 ip arp inspection trust

! Client access ports
interface range FastEthernet0/1 - 23
 description User ports
 ip verify source
 ip dhcp snooping limit rate 15
 storm-control broadcast level 0.50 0.30
 spanning-tree portfast
 spanning-tree bpduguard enable

This blocks rogue DHCP, ties IP-to-MAC via DHCP bindings (IP Source Guard), throttles broadcast storms, and prevents accidental loops. Test during a maintenance window.

Recommended Answers

All 6 Replies

Member Avatar for mjdodd

do you get the same problem if you connect using hard wire ethernet. If so then it is in the laptop in terms of its taking over the modem.
since you say that without the connection the modem works it would seem to me that the wireless connection may be overheating the modem (it has to trasmit and receive and this can involve dispersing heat in th output transistor the transmitter pat of it. If this is the case then you may need to look at cooling the modem in some form.
A very rare but none the less real possibility is that here are other wireless signals (eg fro a close by microwave) that are interrupting your signal and then the modem then hangs.
M

Member Avatar for DammyDani

Thanks for your reply mjdodd. Yeah, i get the same problem when connected via ethernet. Also, the problem occurs whether that laptop (my laptop actually) is using DHCP or static addressing. I guess my laptop is taking over the modem in a way, but i cant figure out how.

Member Avatar for mjdodd

I suspect the laptop is starting ok with the modem and then perhaps the output on the electronics (ethernet and Wireless) are getting 'jammed' and thus locking the modem into waiting for the signal from the output side of the laptop which has seized. if reinstalling all the drivers (ethernet and wireless and perhaps the modem) does not work then I fear it may be professional electronics help.
Increasingly it sounds to me like a heat buildup problem and then an electrical component switching off to prevent damage.
m

commented: I fail to see how this relates -2
Member Avatar for sknake

It sounds like this laptop isn't being a good citizen on the network. It could be malicious software or a misconfiguration on the laptop.

Download Wireshark and install it on the problematic ACER laptop. Start a packet capture, connect it to the internet at work, let it remain online for some time, stop the packet capture then post it here. Once we take a look at the pcap we should have a pretty good idea of whats going on.

DISCLAIMER -- Password and other sensitive information may be contained in the packet capture. Normally I try to keep everything on the forum but due to the sensitive nature if you want an FTP to upload the file then let me know.

Edited by sknake because: n/a
Member Avatar for DammyDani

Thanks a lot guys, i think i've been able to solve the problem. I cleaned the acer laptop of viruses, trojans etc. with Kaspersky internet security and i also enabled DHCP snooping on the switch. The network has been fine for the past three days, with or without the acer laptop connected to the network.

Thanks a mil

Member Avatar for sknake

Please mark this thread as solved (as you solved your own problem :)) and good luck!

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.