Hotspot and multiple IP's per MAC

RouterOS General
1

I am running hotspot and keep running into an issue with multiple IP’s per MAC, current setting is 1 but when increaded the same issue is seen.

ip hotspot host print
0 DA xx:xx:xx:B2:06:91 10.123.0.40 10.123.0.40 auth-hotspot
1 H xx:xx:xx:B2:06:91 10.123.2.198 10.123.2.198 auth-hotspot

This device currently has 10.123.2.198 assigned to it, and is receiving hotspot page.

What causes this to happen and what can be done to help this from happening? (why has IP changed / old one not removed from list)

DHCP lease time is set to 10 days and hotspot session timeout 1 day, no idle timeout, no keepalive timeout.

Thanks!

-dan

2

Any guidance on this? I seem to find several old posts reguarding the same problem but never a resolution.

I also have several public IP’s showing up in the host table, I have not found any posts that explain what causes this.

Any direction is appreciated.

3

I have the same problem here, when i look at IP > Hotspot > Hosts i can notice some public IP at host table, and some duplicated Mac address.

A curious thing is that some of that duplicated Mac address come from inside the network of my client, but, he have a router there and its configurated as route not as a bridge.

Anyone knows how we can solve or whats causing this problem?

4

I have been battling the problem non stop and have some information I found today.

When doing a packet capture between a users router and the mikrotik hotspot, I see a ton of ICMP redirects that are sourced from the users router.

Each of the destination IP’s in the redirect shows up as the other IP’s in the hotspot host table with the users router MAC address.

I am testing now, simply blocking ICMP redirect packets from hitting the mikrotik.

I plan on investigating more, as I would like to know why the router(s) are sending redirects.

I will post another update if my testing fixes the issue or if I find any other information.

5

The ICMP redirects are triggered by SSDP messages from other devices. Still tracking the source, I presume a router / routers plugged in backwards are the root cause of the issue.

6

hmm just let me know if u find a solution, cause this sucks!

far as i know, this can ocur when we have a client with a router configured as bridge, but with the clients that happen this duplication, their router is configured as route mode, but it keeps happening this and i can´t figure out the source of the problem. :frowning:

dancms, what kind of router do u use on ur client? here i have some Dlink´s, TP Links and a router with rtl8187 chipset with Aprouter firmware, its a firmware made by ppls here on Brazil.

7

Our users have several different types of routers, belkin, dlink, netgear, cisco/linksys.

I have verified that blocking ICMP redirects has fixed the problem in a lab environment.

I was unsuccessful in blocking this traffic with the mikrotik firewall, although I’m sure it can be done.

I setup an access list on a cisco switch that the mikrotik hotspot plugs into and it is working properly.

This access list will be applied in a production environment on Monday.

While this may be a solution, I sill would like to know why these redirects are occuring and why mikrotik is picking them up and creating host entries for the IP’s, I plan to do more investigating into this.

Will post update after active in production environment.

My simple access-list used:
access-list 100 deny icmp any any redirect
access-list 100 permit icmp any any

Port on switch hotspot interface connects to:
int fa 0/1
ip access-group 100 in

If anyone has input to why this behavior occurs or how to create this firewall rule on the mikrotik, it is appreciated.

I have tried:
chain=x action drop protocol=icmp icmp-options=5:1
where x is the chain type, which I tried several with no luck.

Also, my hotspot networks that contain no end user routers, do not have this problem, as the end user routers are what are generating the ICMP redirects.

8

dancms!

Hey man, do u use ip pool and DHCP server? i use both on my Hotspot configuration but looking at one of my HS (i have a few here) i´ve found a RB that i´ve only have configured Ip pool on HS, and guess what? i don´t have this problem on this RB!! i think there is the problem, i will test on another RB, i will disable DHCP Server there and see what we got, try this too, and let me know if solved ur problem, tomorrow i will post some news, see ya!

Regards!

9

We are also seeing issues with this. We’ve tracked it down to Hotspot seeing traffic (mostly multicast) from users (talking protocols mentioned below) and then inserting (invalid) arp / hotspot entries. Working to solve this you can block the traffic in a firewall bridge rule. The traffic you should block is mentioned on this post from Princeton.

http://www.net.princeton.edu/filters/index.html

10

Can you not simply disable Address Pool in the hotspot settings?

11

Disabling the address pool doesnt help, this is just the hotspot universal client.

My problem was a result of the same “inserting (invalid) arp / hotspot entries” as a result of ICMP redirects.

Having had my ICMP redirect block in place on my cisco switch for some time now, the problem has not re-appeared.

I still have not had any luck getting this filter to work on the mikrotik itsself.

12

ey man!!
appreciate if you explain to me more detail how you solved the problem.
I have the same situation and I’m desperate.
thank’s..

13

There are a couple ways to ‘get around’ this issue. I say get around because it still happens from time to time in certain cases and I have not sought to identify them as its difficult to replicate.

Fix 1, use switches that support private vlans (as Cisco calls them). This isolates users from each other so icmp redirect messages to not pass between them.

Fix 2, create an access list and apply to the switch port the MikroTik plugs into that is running hotspot. This access list should drop all icmp redirect messages. Depending on switch features, you could alternatively apply the access list to each switch port users attach to or use a vlan acl.

Example Cisco acl to apply at the port level:
Access-list 1 deny icmp any any redirect
Access-list 1 permit ip any any

I have only encountered this issue on networks where several users have routers attached such as dlink, Belkin, linksys, etc.

If I could stop using hotspot I would because it has been a huge headache to deal with. Hoping MikroTik will address this issue at some point.

Hope this helps.

14

thank you very much… :smiley:

15

Any easy resolution with this one if possible to tell us the reason its happening also. Im seeing one mac address getting different ip addresses at the same time so the only eay for me to do is block the mac it self.

Another how is it possible for one device to get a out of range ip address. I got hotspot and have configured 10.10.0.0/24 and yet im seeing aome user who are getting out of tht range like 100.100.0.67 or 192.168.0.54. how can that be poasible in one interface?..

Please help

16

Please someone has found a solution to this problem? I’m having this problem until today, 2019, after all updates of my mikrotik 2011 uias… I have created the rule to block icmp (all icmp traffic) on my switch on the port that is connected to the hotspot and the problem persists.