2 Replies Latest reply: Feb 1, 2012 10:24 AM by Emeka Ezekoka RSS

    mshome.net

    Emeka Ezekoka

      Hi everyone,

       

      For sometime now, some users in my comapny's campus network have been reporting mshome.net as their Connection Specific DNS Suffix.

       

      I have tried checking if they have Internet Connection Sharing turned on, set up DHCP snooping on the switches and VLAN to no avail.

       

      Please does anyone out there have a clue to what might be causing this problem.

       

      A solution will be appreciated.

       

      Thank you

       

      Emeka

        • 1. Re: mshome.net
          Paul Stewart  -  CCIE Security

          I think that can be set various ways.  For example DHCP (which you mentioned), Group Policy, derived from the domain suffix or locally assigned.  If it is being set with DHCP, you could easily see that in Wireshark if you do a release and renew.  That would at least tell you of you are looking in the right place. 

          • 2. Re: mshome.net
            Emeka Ezekoka

            Thanks Paul, my co-worker setup a secondary VLAN on the same subnet as the rogue DHCP machines, then we did a trace ip mac from source to destination IP. It turned out to be two laptops on the network, after our security team scanned their machines, one had ICS turned on, on their wireless network but I don't understand how that was causing problems on the wired. I did check ICS status only on the wired.