Hello. I have a Network with Router Os and Hotspot is running on it. It’s working as intended and there is no problem except when a Linux client is connected to the network (not login to the network; just connect to one of the access points) and then the other users can’t login to the hotspot and even ping the Router IP; it seems that some services on Linux cause Network request routed to Linux node instead of Router. anyone can help with this strange problem? any help be appreciated.
Can you give some more info? The config? The IP of the linux host when you got the issue? A packet capture?
Common cause for these problems is that client’s device has DHCP server enabled that broadcasts false data to the network. Different kind of “sharing” or “server” functionalities. MikroTik has functionality to notice rogue DHCP servers and send you notification.
Thanks for your answer. I’ve checked the present of rogue DHCP server and there was nothing, even activate Mikrotik rouge DHCP server alert and nothing find . do you have any other idea that what is root cause of this problem.
Thanks for your answer. this a Wireshark sniff for packets that are sent to network by Linux node if can help
No. Time Source Destination Protocol Length Info src Mac
1063 52.946910 172.17.254.162 224.0.0.251 MDNS 160 Standard query 0x0000 PTR _nfs._tcp.local, "QM" question PTR _ftp._tcp.local, "QM" question PTR _webdav._tcp.local, "QM" question PTR _webdavs._tcp.local, "QM" question PTR _sftp-ssh._tcp.local, "QM" question PTR _smb._tcp.local, "QM" question PTR _afpovertcp._tcp.local, "QM" question Tp-LinkT_bd:22:87
1068 53.069168 172.17.254.162 224.0.0.251 MDNS 225 Standard query 0x0000 ANY ???'s remote desktop on ???-desktop._rfb._tcp.local, "QM" question ANY ???-desktop.local, "QM" question ANY 162.254.17.172.in-addr.arpa, "QM" question A 172.17.254.162 PTR ???-desktop.local SRV 0 0 5900 ???-desktop.local TXT Tp-LinkT_bd:22:87
1069 53.107940 172.17.254.162 224.0.0.251 MDNS 156 Standard query response 0x0000 PTR _rfb._tcp.local PTR ???'s remote desktop on ???-desktop._rfb._tcp.local Tp-LinkT_bd:22:87
1071 53.318731 172.17.254.162 224.0.0.251 MDNS 225 Standard query 0x0000 ANY ???'s remote desktop on ???-desktop._rfb._tcp.local, "QM" question ANY ???-desktop.local, "QM" question ANY 162.254.17.172.in-addr.arpa, "QM" question A 172.17.254.162 PTR ???-desktop.local SRV 0 0 5900 ???-desktop.local TXT Tp-LinkT_bd:22:87
1082 53.569914 172.17.254.162 224.0.0.251 MDNS 225 Standard query 0x0000 ANY ???'s remote desktop on ???-desktop._rfb._tcp.local, "QM" question ANY ???-desktop.local, "QM" question ANY 162.254.17.172.in-addr.arpa, "QM" question A 172.17.254.162 PTR ???-desktop.local SRV 0 0 5900 ???-desktop.local TXT Tp-LinkT_bd:22:87
1087 53.770040 172.17.254.162 224.0.0.251 MDNS 207 Standard query response 0x0000 TXT, cache flush A, cache flush 172.17.254.162 PTR, cache flush ???-desktop.local SRV, cache flush 0 0 5900 ???-desktop.local Tp-LinkT_bd:22:87
1089 53.945556 172.17.254.162 224.0.0.251 MDNS 160 Standard query 0x0000 PTR _nfs._tcp.local, "QM" question PTR _ftp._tcp.local, "QM" question PTR _webdav._tcp.local, "QM" question PTR _webdavs._tcp.local, "QM" question PTR _sftp-ssh._tcp.local, "QM" question PTR _smb._tcp.local, "QM" question PTR _afpovertcp._tcp.local, "QM" question Tp-LinkT_bd:22:87
1090 54.282674 172.17.254.162 224.0.0.251 MDNS 217 Standard query response 0x0000 PTR _rfb._tcp.local PTR ???'s remote desktop on ???-desktop._rfb._tcp.local TXT, cache flush SRV, cache flush 0 0 5900 ???-desktop.local A, cache flush 172.17.254.162 Tp-LinkT_bd:22:87
1112 54.942219 172.17.254.162 224.0.0.251 MDNS 207 Standard query response 0x0000 TXT, cache flush A, cache flush 172.17.254.162 PTR, cache flush ???-desktop.local SRV, cache flush 0 0 5900 ???-desktop.local Tp-LinkT_bd:22:87
1118 55.048739 172.17.254.162 224.0.0.251 MDNS 197 Standard query 0x0000 ANY d.2.4.8.e.c.6.8.6.0.8.0.c.7.e.9.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa, "QM" question ANY ???-desktop.local, "QM" question AAAA fe80::9e7c:806:86ce:842d PTR ???-desktop.local Tp-LinkT_bd:22:87
1123 55.299073 172.17.254.162 224.0.0.251 MDNS 197 Standard query 0x0000 ANY d.2.4.8.e.c.6.8.6.0.8.0.c.7.e.9.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa, "QM" question ANY ???-desktop.local, "QM" question AAAA fe80::9e7c:806:86ce:842d PTR ???-desktop.local Tp-LinkT_bd:22:87
1129 55.549682 172.17.254.162 224.0.0.251 MDNS 197 Standard query 0x0000 ANY d.2.4.8.e.c.6.8.6.0.8.0.c.7.e.9.0.0.0.0.0.0.0.0.0.0.0.0.0.8.e.f.ip6.arpa, "QM" question ANY ???-desktop.local, "QM" question AAAA fe80::9e7c:806:86ce:842d PTR ???-desktop.local Tp-LinkT_bd:22:87
1130 55.550809 172.17.254.162 224.0.0.251 MDNS 87 Standard query response 0x0000 A, cache flush 172.17.254.162 Tp-LinkT_bd:22:87
1138 55.750672 172.17.254.162 224.0.0.251 MDNS 185 Standard query response 0x0000 PTR, cache flush ???-desktop.local AAAA, cache flush fe80::9e7c:806:86ce:842d Tp-LinkT_bd:22:87
1143 55.949255 172.17.254.162 224.0.0.251 MDNS 160 Standard query 0x0000 PTR _nfs._tcp.local, "QM" question PTR _ftp._tcp.local, "QM" question PTR _webdav._tcp.local, "QM" question PTR _webdavs._tcp.local, "QM" question PTR _sftp-ssh._tcp.local, "QM" question PTR _smb._tcp.local, "QM" question PTR _afpovertcp._tcp.local, "QM" question Tp-LinkT_bd:22:87
1155 56.456136 172.17.254.162 224.0.0.251 MDNS 245 Standard query response 0x0000 PTR _rfb._tcp.local PTR ???'s remote desktop on ???-desktop._rfb._tcp.local TXT, cache flush SRV, cache flush 0 0 5900 ???-desktop.local AAAA, cache flush fe80::9e7c:806:86ce:842d A, cache flush 172.17.254.162 Tp-LinkT_bd:22:87
1174 56.923318 172.17.254.162 224.0.0.251 MDNS 157 Standard query response 0x0000 PTR, cache flush ???-desktop.local Tp-LinkT_bd:22:87
1181 57.115781 172.17.254.162 224.0.0.251 MDNS 235 Standard query response 0x0000 TXT, cache flush A, cache flush 172.17.254.162 PTR, cache flush ???-desktop.local SRV, cache flush 0 0 5900 ???-desktop.local AAAA, cache flush fe80::9e7c:806:86ce:842d Tp-LinkT_bd:22:87
1231 59.096770 172.17.254.162 224.0.0.251 MDNS 185 Standard query response 0x0000 PTR, cache flush ???-desktop.local AAAA, cache flush fe80::9e7c:806:86ce:842d Tp-LinkT_bd:22:87
1254 59.946642 172.17.254.162 224.0.0.251 MDNS 160 Standard query 0x0000 PTR _nfs._tcp.local, "QM" question PTR _ftp._tcp.local, "QM" question PTR _webdav._tcp.local, "QM" question PTR _webdavs._tcp.local, "QM" question PTR _sftp-ssh._tcp.local, "QM" question PTR _smb._tcp.local, "QM" question PTR _afpovertcp._tcp.local, "QM" question Tp-LinkT_bd:22:87
1393 67.949839 172.17.254.162 224.0.0.251 MDNS 160 Standard query 0x0000 PTR _nfs._tcp.local, "QM" question PTR _ftp._tcp.local, "QM" question PTR _webdav._tcp.local, "QM" question PTR _webdavs._tcp.local, "QM" question PTR _sftp-ssh._tcp.local, "QM" question PTR _smb._tcp.local, "QM" question PTR _afpovertcp._tcp.local, "QM" question Tp-LinkT_bd:22:87
1709 83.956195 172.17.254.162 224.0.0.251 MDNS 160 Standard query 0x0000 PTR _nfs._tcp.local, "QM" question PTR _ftp._tcp.local, "QM" question PTR _webdav._tcp.local, "QM" question PTR _webdavs._tcp.local, "QM" question PTR _sftp-ssh._tcp.local, "QM" question PTR _smb._tcp.local, "QM" question PTR _afpovertcp._tcp.local, "QM" question Tp-LinkT_bd:22:87
2357 115.958239 172.17.254.162 224.0.0.251 MDNS 160 Standard query 0x0000 PTR _nfs._tcp.local, "QM" question PTR _ftp._tcp.local, "QM" question PTR _webdav._tcp.local, "QM" question PTR _webdavs._tcp.local, "QM" question PTR _sftp-ssh._tcp.local, "QM" question PTR _smb._tcp.local, "QM" question PTR _afpovertcp._tcp.local, "QM" question Tp-LinkT_bd:22:87
3635 179.958283 172.17.254.162 224.0.0.251 MDNS 160 Standard query 0x0000 PTR _nfs._tcp.local, "QM" question PTR _ftp._tcp.local, "QM" question PTR _webdav._tcp.local, "QM" question PTR _webdavs._tcp.local, "QM" question PTR _sftp-ssh._tcp.local, "QM" question PTR _smb._tcp.local, "QM" question PTR _afpovertcp._tcp.local, "QM" question Tp-LinkT_bd:22:87
4747 233.215003 172.17.254.162 224.0.0.251 MDNS 79 Standard query 0x0000 PTR _scanner._tcp.local, "QM" question Tp-LinkT_bd:22:87
4764 234.001780 172.17.254.162 224.0.0.251 MDNS 79 Standard query 0x0000 PTR _scanner._tcp.local, "QM" question Tp-LinkT_bd:22:87
4781 234.883965 172.17.254.162 255.255.255.255 UDP 60 47994 → 3289 Len=15 Tp-LinkT_bd:22:87
4797 235.894850 172.17.254.162 255.255.255.255 UDP 79 36018 → 1124 Len=37 Tp-LinkT_bd:22:87
6304 307.958194 172.17.254.162 224.0.0.251 MDNS 160 Standard query 0x0000 PTR _nfs._tcp.local, "QM" question PTR _ftp._tcp.local, "QM" question PTR _webdav._tcp.local, "QM" question PTR _webdavs._tcp.local, "QM" question PTR _sftp-ssh._tcp.local, "QM" question PTR _smb._tcp.local, "QM" question PTR _afpovertcp._tcp.local, "QM" question Tp-LinkT_bd:22:87
16450 563.956379 172.17.254.162 224.0.0.251 MDNS 160 Standard query 0x0000 PTR _nfs._tcp.local, "QM" question PTR _ftp._tcp.local, "QM" question PTR _webdav._tcp.local, "QM" question PTR _webdavs._tcp.local, "QM" question PTR _sftp-ssh._tcp.local, "QM" question PTR _smb._tcp.local, "QM" question PTR _afpovertcp._tcp.local, "QM" question Tp-LinkT_bd:22:87
17171 588.318005 172.17.254.162 255.255.255.255 DHCP 342 DHCP Request - Transaction ID 0xd6c94d59 Tp-LinkT_bd:22:87
27909 1075.953349 172.17.254.162 224.0.0.251 MDNS 160 Standard query 0x0000 PTR _nfs._tcp.local, "QM" question PTR _ftp._tcp.local, "QM" question PTR _webdav._tcp.local, "QM" question PTR _webdavs._tcp.local, "QM" question PTR _sftp-ssh._tcp.local, "QM" question PTR _smb._tcp.local, "QM" question PTR _afpovertcp._tcp.local, "QM" question Tp-LinkT_bd:22:87
28765 1116.259549 172.17.254.162 255.255.255.255 DHCP 342 DHCP Request - Transaction ID 0xd6c94d59 Tp-LinkT_bd:22:87
47036 1651.339738 172.17.254.162 255.255.255.255 DHCP 342 DHCP Request - Transaction ID 0xd6c94d59 Tp-LinkT_bd:22:87
73152 2099.947330 172.17.254.162 224.0.0.251 MDNS 160 Standard query 0x0000 PTR _nfs._tcp.local, "QM" question PTR _ftp._tcp.local, "QM" question PTR _webdav._tcp.local, "QM" question PTR _webdavs._tcp.local, "QM" question PTR _sftp-ssh._tcp.local, "QM" question PTR _smb._tcp.local, "QM" question PTR _afpovertcp._tcp.local, "QM" question Tp-LinkT_bd:22:87
75145 2181.027522 172.17.254.162 255.255.255.255 DHCP 342 DHCP Request - Transaction ID 0xd6c94d59 Tp-LinkT_bd:22:87
98553 2708.529788 172.17.254.162 255.255.255.255 DHCP 342 DHCP Request - Transaction ID 0xd6c94d59 Tp-LinkT_bd:22:87
98961 2718.504579 172.17.254.162 255.255.255.255 DHCP 342 DHCP Request - Transaction ID 0xd6c94d59 Tp-LinkT_bd:22:87
Device with IP address 172.17.254.162 is trying to perform some service auto-discovery … and destination for most is a multicast address, except for DHCP where destination is a global broadcast address. It could be that it’s also advertising its own services … using MDNS / bonjour protocol.
Last column (src MAC) says that offending device is some TpLink device.
Any other suggestions for this problem?