When setting up a new broadband connection or adding new devices to a network, you often encounter “IP address conflicts” or DNS issues. These problems are not hardware failures of the router or network card but rather issues with IP address configuration and subnetting. In a simple network, using automatic IP address assignment is sufficient without extra configuration. However, in a slightly more complex LAN, setting the router’s IP address, subnetting, and gateway IP address allocation requires some expertise. Below, we will provide a comprehensive analysis of how to configure router IP addresses, gateways, and DNS.
Why do these external router IP addresses look for computers inside the campus? From analyzing the collected data, it’s not hard to see that these external hosts are mainly targeting three specific internal computers.
How can you correctly set the router IP address? Here, we mainly introduce the specific steps for configuring the router IP address. It turns out that when a router receives a data packet destined for an unknown router IP address (meaning the router doesn’t know the destination route), it attempts to send an ARP broadcast to resolve it. If a target host responds to this ARP broadcast, the router forwards the data packet to that target host.
If the router receives no response, it will send ARP requests for the next 4 data packets. If, by the time the 6th data packet arrives, the target host’s MAC address has still not been resolved, by default, the router will drop the 6th and subsequent data packets for the next 20 seconds and return a “Host Unreachable” ICMP message to the source host.
The first line from computer B’s log also proves this. The router sent an ARP query into that network segment, looking for a computer with the router IP address “222.222.222.191.” No computer responded, so the router determined that the target host does not exist in that segment. Consequently, it returned an ICMP message to the source computer indicating the destination host was unreachable, notifying the source host of the problem while dropping the original data packet. At this point, the issue is clear: the ICMP messages recorded by the router are all “Destination Unreachable” messages sent back to the source addresses. So, why do these external router IP addresses look for campus computers? From analyzing the collected data, it’s not hard to see that these external hosts are mainly targeting three specific internal computers. After checking historical logs, the main identical records for these three computers were found:
07:52:19 Jul 09 07:50:02 %ACL_LOG-I-PERMIT, ACL [out]
on "uplink" TCP 222.222.222.136:3159 -> 61.173.209.101:6881
08:00:15 Jul 09 07:53:50 %ACL_LOG-I-DENY, ACL [out]
08:00:15 Jul ACL [out]
on "uplink" TCP 222.222.222.12:3194 -> 219.121.133.197:6883
08:00:15 Jul 09 07:57:59 %ACL_LOG-I-DENY, ACL [out]
on "uplink" TCP 222.222.222.220:3196 -> 210.238.6.177:6881
The destination ports these three hosts connect to are fixed between 6881 and 6889, which are the commonly used ports for the now-popular BitTorrent (BT) downloads. It’s no wonder these logs never appeared before and only showed up with the recent popularity of BT. The main reason is that when these hosts use BT to download, they leave records on the BT server, allowing other hosts to download resources from them. When these hosts shut down, the router tells the external hosts that it cannot find them anymore.
Since the logging service records information at Layer 3 and above, while the data packets received by the router are dropped at Layer 2, these abnormal inbound packets are not recorded in the logs. To reduce the volume of router logs, use the command “ip disable icmp-messages destination-unreachables” in configuration mode to suppress the forwarding of such messages. Both of these faults were triggered by ICMP, and from a certain perspective, neither was a system configuration issue but rather caused by external factors. Such faults require thorough analysis to identify the root cause, followed by appropriate configuration changes to resolve them.
First, connect the COM port of the laptop to the router’s CONSOLE port using a dedicated router CONSOLE cable, and launch a terminal emulator on the laptop to establish a connection with the router. After powering on the router, you will see the following boot information in the terminal:
Processor: R5000 rev 2.1 [0x2321], 198 MHz, (bus: 66 MHz), 64 MB DRAM
I-Cache 32 KB, linesize 32. D-Cache 32 KB, linesize 32
L2-Cache 512 KB, linesize 32, cache enable
Mounting 8MB Linear external flash card …Done
initializing system …….Failure
Autoboot in 2 seconds – press ESC to abort and enter prom.
The last line indicates that system initialization failed. Upon seeing “Autoboot in 2 seconds –