CAM Tablet problems while roaming?
by Toperharrier - 1/19/13 2:49 PM
Hi there, Ive been running through a problem in the last few weeks since I added a 2nd wireless AP to my home network to provide better Wifi coverage along the house.
Lets say first, Im from Europe and I have a Cable ISP.
First router (cable-modem-router) get Internet from a Coaxial cable coming from the wall (2nd one has not any coaxial imput as its a neutral router so I cant revert them), second one is connected to the first one on a LAN-to-LAN basis.
Set-up is as follows:
LAN IP: 192.168.1.1
Subnet Mask: 255.255.255.0
DHCP Server: 192.168.1.10/192.168.1.100
LAN IP: 192.168.1.2
Subnet Mask: 255.255.255.0
DHCP/QoS/Firewall/NAT/UPnP all disabled
Theres no MAC restriction in any of them, both are set-up as allow-all. Theres a PC connected to LAN1 from (A), rest of devices are all Wireless.
Their wifi channels are set different, just like the SSIDs.
Setup seems pretty simple, I get Internet access from both PC and wireless devices connected either to A or B. I can access to both routers from any side. So that should mean setup is OK(?).
Problem is as follows, Imagine a wireless device I connect to A (WLAN_R), then B (WLAN_S), then A again. It has dynamic IP addressing.
(A) IP Assigned in 1s ---> (B) IP Assigned in 1s ---> (A) 5mins to assign IP... ---> (B) 1s again...
(B) IP Assigned in 1s ---> (A) 5mins... ---> (A) 1s...
So I firstly though it could be a DHCP problem/conflict (how in earth? B DHCP server is disabled and not static filters), but no.
I made the devices to connect with static IP. Problem is, I connect fine and get network//Internet access, but when it comes to the same spot (connecting to A after being in B) It "gets assigned" an IP in 1s but I cant access network or Internet for the rest of the time (up to the same 5mins..). Cant access the routers either from the wireless device.
That clearly means its not a DHCP issue, moreover when in the "fail time" the device cant "connect" to A, I can connect any other wireless device to A perfectly (if it hasnt been in B before, of course...)
When I have the Tablet connected to B, I can clearly see it under the LAN route table in A hostpage, stating it as an Ethernet connection. When I connect the Tablet to A, I can see it as Wireless (N) under the same tab (in the "fail time" theres no device ofc).
My guess is the CAM table that routes the MAC address to the physical port where it is located that MAC its getting not refreshed properly and so the route of the Tablet keeps addressing it to the ethernet port rather than its new address (A wireless). Any thoughts?
Ive been trying to spoof the problem but Im running into some problem, first one, both are switchs, second one, I dont own a hub and Ive noticed how hard to find one in my local area that its not really a switch after all (and they are **** expensive). I guess the 2nd router just refreshes its CAM table routes fine so thats the reason I have no problem going A-> B.
To note, I can see the DHCP Request (cos of being broadcast) and ACK (in the actual PC spot with Wireshark even when its directed to the tablet and not the PC nor BC/MC [prominiscuous mode working?]) in the first connect to A.
Can see DHCP requests when connecting to B (no Offer/Request/ACK but it connects fine).
In the A connecting problem spot, I can only see continous Requests/Discoveries and ARPs looking for the router coming from Tablet IP but no response (I guess its addressing the responses to the old eth route, so thats why It doesnt go on with the handshake), no offers/ACK, only after the 5mins when the Tablet ends up connecting, then I can see FULL DHCP process (Discover/Offer/Request/ACK)! even when Offer and ACK are sent from router to Tablet IP... promiscuous mode working? switch falling and becoming a simple hub?
The A router has port forwarding, and Ive tried making the BOOTP-server services to redirect to my PC IP (the one attached to A thru LAN port), but it seems I cant see **** anyway in the first 2 spots I commented earlier (wanna spoof from A to B to see if A response to B when Tablet is attached in A Wlan and not eth port directing to B), thus Im not sure if this is the same as "port mirroring" but attached to a service in the router rather than a port. Theres any spot for my PC I could sniff all this traffic? I thought about getting a 2nd network card for it so I could just make it in the middle of A-B and link both nets from Windows, would this work? I guess I couldnt see any other LAN connected devices to A/B but I should see the routers traffic between any wireless station from A/B (?), thus making all ARP/DHCP process visible (?).
I may try with MiTM, any advice? As far as Im concerned I should be able to "intercept" the traffic going to the related Tablet MAC address, so it wouldnt be a problem the route being false for the Tablet MAC in the CAM table, because it would send it to my PC MAC wich has a correct physical route in such table due to not roaming.
Hope I didnt scare you all with such walltext, and I guess theres a lot of stuff related to the sniffing that may be incorrectly analyzed (nuff sniffer here), just wanted to make sure you get the point of the problem as It gave me some headaches to explain to some friends cable-guy (who couldnt help at all).
Any thought, advice or correction about something I may be doing incorrectly are highly appreciated. Im friendly with new bibliography so feel free to.