Hello everyone,

I have a network with some 802.11B/G Mikrotik Hotspots using different ROS versions (3.22, 3.30, 4.06, 4.10, 4.11).
Most of my current clients are using UBNT Nanostation 2. They are cheap, easy to install and robust.
Now I've just started using Nanostation M2 (the new ones with MIMO, N support and TDMA Airmax).

I have two locations where I installed those new M2. One place is using RouterOS 3.30. The other place is running 4.11.

At the first place I have no problems using M2.

At the second place, clients using M2 are shown on the Hosts tab more than once:
[See IMG1 attached]
MACs: 00:15:6D:10:59:F3, 00:15:6D:B0:E9:FB

They are listed with two different IP addresses. IPs in 10.20.10.0/24 are the "correct" addresses. IPs 192.168.1.32, 192.168.1.146 are the client's Computer IP address (IP which is supposed to be NATted so it shouldn't appear here).

Sometimes things go mad and look like IMG2. Those public IPs are not from my network.


If I try to remove those invalid IPs they reappear almost instantly.
Client device is working properly. I have replaced them three times each (using new UBNT M2 every time) and I've run tests on that place (it's right under my office) with another M2 with same results.
I discarded client configuration issues by comparing to Nanostation2 and to M2 installed in other places.

That problematic node is running RouterOS 4.10, right now, but I've tested using 4.11 and it didn't change.
Another place with UBNT M2 as clients is running RouterOS 3.30 and it does not have any of these problems.

Any ideas?

Burn the nanostation with the MAC: 00:15:6D:B0:E9:FB

It's possible that this man was injecting IPs to your network to make a Man in the middle attack?

There are many M2 with that same problem to burn'em all. Too much coincidence six of my customers are trying to make man in the middle attacks.

I add that I've just discovered another UBNT M2 that behaves like the others that is connected to a RouterOS 3.30. I'm starting to suspect that is UBNT's fault...