Skip to main content

(Network Loop) Upstream Network Clients Appearing in PC61 LAN Client List

R
Written by Rohit Yadav

(Network Loop) Upstream Network Clients Appearing in PC61 LAN Client List

Production-ready troubleshooting + remediation guide (field-friendly)

1. Executive Summary

  • Customer observed devices in PC61 client list with IP addresses from the upstream WAN network (10.10.10.0/24).

  • PC61 is designed to show LAN-side clients; therefore, upstream IPs in the LAN client list strongly indicates a Layer-2 broadcast-domain leak or physical miswiring.

  • Most common causes are: (1) ISP router connected to both PC61 WAN and PC61 LAN, or (2) an unmanaged switch bridging WAN and LAN into a single broadcast domain.

  • Impact is high for restaurants/small offices: POS terminals may obtain wrong IPs, printing fails, payments fail, and security policies can be bypassed.

2. Purpose

To explain why upstream (WAN-side) IP addresses can appear in the PC61 LAN client list, how ARP/DHCP broadcasts create this symptom, and to provide step-by-step detection and resolution procedures.

3. Scope

  • Applies to PC61 deployments where WAN and LAN are expected to be strictly isolated.

  • Applies to sites using VLANs on the LAN side (e.g., POS/Printer/Camera/Guest).

  • Does not cover advanced routed discovery across multiple routers (Layer-3 visibility beyond PC61).

4. Environment & Intended Design

Assumed addressing for this incident:

WAN / Upstream network (ISP ⇄ PC61 WAN)

10.10.10.0/24

PC61 WAN interface IP

Obtained from 10.10.10.0/24 (static or DHCP from ISP router)

LAN VLAN 1

192.168.250.0/25

LAN VLAN 2

172.16.31.0/24

PC61 LAN role

Default gateway + DHCP server for LAN VLANs (recommended)

Expected behavior:

  • PC61 client list should show only LAN-side clients (VLAN 1 and VLAN 2).

  • No clients with 10.10.10.x should appear as LAN clients.

5. PC61 Client Learning Logic (Why This Symptom Is Possible)

PC61 typically learns clients using two mechanisms: passive traffic observation and periodic ARP probing. If PC61 receives client traffic or ARP requests/replies on a LAN interface, it will record the source as a LAN client even if the IP address belongs to an unexpected subnet.

Reference flow diagram:

PC61 CLIENT IDENTIFICATION LOGIC Device on LAN Does device send traffic to PC61? >Yes (Every 3-5 min .- - IP address - parallel process) - MAC address - Interface / LAN port - Last seen timestamp 1 Client marked ACTIVE PC61 sends ARP broadcast on LAN interface Yes Does client reply to ARP? No Client confirmed alive, No ARP response + Timestam updated no traffic over intervals · Client is ADDED when: · Client is MARKED INACTIVE when: - It sends traffic to PC61 - Silent over multiple intervals - It replies to ARP probe - No ARP replies observed

Figure 1 — PC61 client identification and aging logic (simplified).

6. Problem Statement

  • Customer reports that PC61 shows clients with IPs in 10.10.10.0/24.

  • PC61 should only show LAN-side clients (192.168.250.0/25 and 172.16.31.0/24).

  • This indicates upstream traffic is being seen on the LAN side (broadcast leakage / bridging).

7. Root Cause

WAN and LAN have been unintentionally connected together at Layer-2. This merges both sides into the same broadcast domain, allowing ARP and DHCP broadcasts to cross between WAN and LAN. When PC61 receives this traffic on a LAN port, it learns those upstream IP/MAC addresses as if they were LAN clients.

INTERNET WAN MISCONFIGURATION 10.10.10/24 LAN PC61 Router ISP Router 10.10.101.2 LAN 192.168.250 Unmanged Switch 192.168.250.0/25 Do 00 POS POS PC Traffic / DHCP Discovery Single Broadcast Domain

7.1 Common Real-World Miswiring Scenarios

Scenario A — ISP router connected to both PC61 WAN and PC61 LAN (dual-homing mistake)

  • One cable: ISP router → PC61 WAN (correct).

  • Second cable: ISP router → PC61 LAN (wrong).

  • Result: Broadcast leakage; PC61 learns upstream devices on LAN port; LAN devices may also receive upstream DHCP offers.

Scenario B — Unmanaged switch bridging WAN and LAN into one broadcast domain (most common)

  • ISP router LAN port → Unmanaged switch.

  • PC61 WAN → same unmanaged switch.

  • PC61 LAN → same unmanaged switch (to 'provide LAN to POS/PC').

  • Result: Entire site becomes a single VLAN/broadcast domain; DHCP offers come from both ISP router and PC61; ARP is flooded everywhere.

8. What Happens on the Wire (DHCP + ARP Breakdown)

8.1 DHCP (Why clients sometimes get 10.10.10.x)

  1. A POS/PC boots and sends a DHCP DISCOVER (broadcast).

  2. An unmanaged switch (or bridged network) floods the broadcast out all ports.

  3. Both the ISP router and PC61 receive the DHCP DISCOVER.

  4. Both devices may reply with DHCP OFFER.

  5. The client may accept either offer depending on timing, causing random IP assignment (sometimes 10.10.10.x, sometimes LAN VLAN IP).

8.2 ARP (Why PC61 learns upstream IPs on LAN)

  1. ARP requests are broadcast-based on a local segment.

  2. With WAN/LAN bridged connection between Pronto Router and ISP, ARP broadcasts from the upstream segment reach PC61 LAN interfaces.

  3. PC61 sees ARP frames on the LAN port and records the source IP/MAC/port as a connected LAN client.

  4. PC61 client list now includes 10.10.10.x addresses (symptom).

9. Business & Technical Impact

  • POS may obtain wrong IP subnet → payment terminals offline, order sync fails.

  • Printers and kitchen display systems may disappear due to subnet mismatch.

  • Security policies (VLAN isolation, firewall rules, guest isolation) can be bypassed.

  • Intermittent outages due to DHCP conflicts, duplicate gateways, or asymmetric routing.

  • High operational risk during peak business hours.

10. Indicators / Symptoms Checklist

  • PC61 client list contains IPs outside LAN VLAN ranges (e.g., 10.10.10.x).

  • Some POS/PC devices show gateway as ISP router instead of PC61.

  • Intermittent connectivity: works for some devices, fails for others.

  • Duplicate DHCP servers detected (leases visible on both ISP router and PC61).

  • Guest devices can see internal devices (loss of segmentation).

  • Switch LEDs flashing heavily; possible loops if unmanaged gear is involved.

11. Step-by-Step Detection Procedure (Field Technician Friendly)

11.1 Confirm the ‘wrong subnet’ symptom

  1. Pick one affected POS/PC device and record: IP address, subnet mask, default gateway.

  2. If the device IP is 10.10.10.x, it is on the upstream subnet (unexpected).

  3. If the device gateway is not the PC61 LAN IP, note the gateway (likely ISP router).

11.2 Check PC61 client list entries

  1. On PC61, locate client list entries showing 10.10.10.x.

  2. For each entry, note: IP, MAC, and the interface/port it is learned on.

  3. If learned on a LAN interface/port, this confirms WAN traffic is leaking into LAN.

11.3 Validate DHCP server collision

  1. Log in to ISP router and check its DHCP lease table (if enabled).

  2. Log in to PC61 and check its DHCP lease table for LAN VLANs.

  3. If the same client MAC appears in ISP DHCP leases, DHCP collision/bridging is occurring.

11.4 Physical and switch-path validation

  1. Inspect cabling: ensure there is exactly one uplink between ISP router and PC61, and it must be connected to PC61 WAN only.

  2. Look for any cable from ISP router (or ISP-side switch) connected to PC61 LAN ports.

  3. Identify any unmanaged switch used near the ISP router or WAN handoff; check whether PC61 LAN is plugged into that same switch.

12. Step-by-Step Resolution Procedure (Fast Recovery)

12.1 Immediate containment (restore POS quickly)

  1. Disconnect any suspected LAN cable from the ISP router or from the ISP-side/unmanaged switch.

  2. Ensure PC61 WAN remains connected to ISP router; do not disturb WAN link.

  3. Reboot affected POS/PC devices (or renew IP) to force a new DHCP lease from PC61.

  4. Verify the device receives the correct subnet IP (192.168.250.x or 172.16.31.x).

12.2 Correct the physical topology

  • ISP router → PC61 WAN (ONLY)

  • PC61 LAN ports → Managed switch (LAN side)

  • POS/Printers/Cameras/Staff devices → Managed switch (correct VLAN ports)

  • Guest Wi‑Fi AP uplinks → Managed switch trunk ports (if VLAN SSIDs are used)

  • No unmanaged/managed switch should be there between WAN and LAN segments or PC61 and ISP Router

12.3 If an unmanaged switch is required temporarily

  • Use unmanaged switch ONLY on the LAN side behind PC61 (never on WAN side).

  • Do NOT plug WAN/upstream into the same unmanaged switch.

  • Label the switch: 'LAN ONLY — DO NOT CONNECT ISP'.

13. Verification Checklist

  • POS/PC devices have IPs ONLY from: 192.168.250.0/25 or 172.16.31.0/24.

  • Default gateway for VLAN 1 clients is PC61 VLAN 1 interface IP.

  • Default gateway for VLAN 2 clients is PC61 VLAN 2 interface IP.

  • No clients in PC61 LAN client list have 10.10.10.x addresses.

  • ISP router DHCP lease table does not contain internal POS/PC MAC addresses (or DHCP is disabled).

  • Printing and POS processing are stable for at least 10–15 minutes.

14. Prevention / Best Practices (MSP Runbook Standard)

  • Physically separate WAN and LAN cabling paths; never re-use WAN-side switches for LAN distribution.

  • Avoid unmanaged switches for any environment with VLANs, POS, or segmentation requirements.

  • Label ports: 'WAN/ISP' vs 'LAN/POS' on both PC61 and switches.

  • Use managed switches with VLAN support and document port roles (Access vs Trunk).

  • Implement DHCP guard / snooping where supported (managed switches).

  • Perform a post-change validation checklist after any cabling or switch change.

15. Escalation Criteria (When to involve Network Engineering)

  • If the physical cabling is correct but 10.10.10.x still appears on LAN client list.

  • If there are multiple switches and the path cannot be confidently traced on site.

  • If the site uses managed switching but VLAN tagging/native VLAN configuration is unclear.

  • If POS or payment services remain unstable after topology correction.

Provide the following details when escalating:

  • PC61 model/firmware and interface names (WAN, VLAN 1, VLAN 2).

  • Screenshots or exports of: PC61 client list entries showing 10.10.10.x (include learned interface/port).

  • DHCP lease tables from PC61 and ISP router (if available).

  • A simple cabling map: ISP router → (devices/switches) → PC61 WAN/LAN → switches → POS/PC.

Appendix A — Quick Reference: What ‘Good’ Looks Like

PC61 WAN IP

10.10.10.x

PC61 LAN VLAN 1 gateway

192.168.250.x (VLAN 1 interface)

PC61 LAN VLAN 2 gateway

172.16.31.x (VLAN 2 interface)

LAN clients should be

192.168.250.x OR 172.16.31.x only

Clients should never be

10.10.10.x on LAN side

Did this answer your question?