When one laptop works but another gets a different gateway, DNS path, or subnet on the same intended LAN, an unexpected second DHCP server is one possible cause.[3] A low-risk first check is to compare the active network configuration on two devices before resetting anything.[1]
Reporting cutoff: The linked official guidance was rechecked at 1:43 p.m. EDT (17:43 UTC) on October 13, 2026.
The expensive wrong turn
Do not factory-reset every router, assign random static addresses, or disable DHCP on the first device you can reach. A router’s DHCP service can supply the client’s IP address, DNS servers, and default gateway; if you turn off the only intended service, automatic addressing can stop across the network.[6] Preserve configurations and identify the intended authority first.
What a competing DHCP server actually does
DHCP clients broadcast a discovery message on their local network, and more than one server can respond with an offer. The client then selects one server and requests its configuration.[3] That design is normal when multiple servers are deliberately coordinated. It becomes a problem when an old router, Wi-Fi extender in router mode, lab server, virtual appliance, or misconfigured access point offers a different subnet, gateway, or DNS plan.
The result can look random: one device receives the intended lease and works, while another accepts the competing offer and follows a different gateway or DNS path.[3] Microsoft describes DHCP discovery as a broadcast sent to available DHCP servers within range and notes that a relay can carry those broadcasts between network segments.[2]
Who is affected—and who is not
- Likely affected: homes or small businesses where different devices show different DHCP server, gateway, DNS, or subnet values on the same wired or Wi-Fi network.
- Common timing: the trouble began after adding a spare router, mesh unit, extender, managed switch, server, firewall, virtual machine host, or temporary event equipment.
- Not the same problem: an address beginning with
169.254usually means Windows did not receive a valid DHCP lease; Microsoft identifies APIPA as the likely fallback when a DHCP client does not receive a valid IPv4 address.[2] Use our separate 169.254/APIPA guide. - Different scope: This guide applies when both DHCP responders can reach the client’s broadcast domain, directly or through a relay.[3][2] Devices deliberately placed behind a second router’s WAN-side downstream network need a separate topology review; see our double-NAT guide.
The safe diagnostic ladder
Preserve the network map before changing it
Photograph cable connections and device labels, record which box is the modem or fiber terminal, identify the intended main router or firewall, and export its configuration if supported. Our router and firewall backup checklist explains what to preserve.
Compare one working device with one failing device
On each Windows PC, open Command Prompt and run ipconfig /all. Microsoft documents that /all displays the full TCP/IP configuration for every adapter.[1] Ignore disconnected adapters and compare the active Ethernet or Wi-Fi adapter.
Phone readers: swipe the table left to see every comparison field.
| Field | Record from the working device | Record from the failing device |
|---|---|---|
| IPv4 address | Address and private subnet | Address and private subnet |
| Subnet mask | Exact value | Exact value |
| Default gateway | Exact address | Exact address |
| DHCP Server | Exact address | Exact address |
| DNS Servers | Every listed address | Every listed address |
| Lease Obtained / Expires | Both timestamps | Both timestamps |
Practical interpretation: different values are evidence to investigate, not automatic proof of hacking.[3][2] VPNs, guest networks, VLANs, static settings, IPv6, and intentional redundant DHCP can produce legitimate differences.
Confirm which DHCP server is intended
Check the approved router, firewall, or server configuration and its DHCP lease list. Match the expected LAN subnet, gateway, DNS settings, and lease range to the working client. If this is a managed business network, ask the administrator whether redundant DHCP or a relay is intentional before disconnecting anything.
Isolate one suspect without erasing it
Practical guidance: after preserving the configuration, disconnect the suspect secondary router or access point from the LAN—or power down only that device—rather than factory-resetting it. Keep the intended router and DHCP service online.[6] If phones, payment systems, cameras, alarms, or remote workers depend on the network, schedule the test and have a rollback path.
Renew one test client, then compare again
Save open work first because this test briefly drops that computer’s network connection. On a Windows test PC that uses automatic addressing, run ipconfig /release and then ipconfig /renew. Microsoft says /release discards the current DHCP configuration and /renew obtains renewed DHCP configuration for automatically addressed adapters.[1] Run ipconfig /all again and record the server, gateway, DNS, subnet, and lease times.
Fix the secondary device in its supported mode
If the second unit is meant only to extend Wi-Fi, use its manufacturer-supported access-point or bridge mode. TP-Link explains that switching from router mode to access-point mode removes router-dependent features, and some models without an operation-mode control can be configured as an access point by disabling their DHCP server.[5] Feature behavior varies by model; TP-Link also warns that guest-network isolation may disappear in access-point mode.[5]
NETGEAR likewise documents that its router supplies IP, DNS, and gateway values by default and allows DHCP to be disabled when another device is the intended server.[6] Use instructions for the exact model; do not assume menus or cable placement are universal.
Verify several clients before declaring victory
Renew and recheck a small, controlled sample of wired and wireless clients. Clients intended to share the same LAN policy should align with the approved DHCP server, gateway, DNS plan, and subnet unless the network documentation identifies an intentional exception such as coordinated redundancy.[3] Confirm internet access, local printers, shared folders, phones, cameras, and business applications rather than stopping when one browser opens.
Good fix versus risky shortcut
Good
- Compare two clients before changing the network.
- Identify the approved DHCP authority.
- Back up the router or firewall configuration.
- Isolate one suspect device reversibly.
- Use the exact model’s supported access-point mode.
- Recheck several clients and business services.
Bad
- Factory-reset every network device.
- Disable DHCP on the known-good router first.
- Assign random static addresses to hide the symptom.
- Assume an unfamiliar DNS address proves compromise.
- Enable DHCP snooping without mapping trusted uplinks.
- Test during business hours with no rollback.
For managed switches: prevention after recovery
On supported managed switches, DHCP snooping can block server replies on untrusted client-facing ports while allowing them on explicitly trusted server or uplink ports. Cisco describes it as a security control that tracks expected DHCP server packets on trusted interfaces and blocks server packets on untrusted interfaces.[4]
Administrator caution: DHCP snooping is not a checkbox to enable blindly. A wrong trust map can block the legitimate server and cause an outage. Document the switch topology, VLANs, approved DHCP servers, relays, uplinks, and rollback commands before deployment.[4]
Two realistic examples
Home-office example: a spare wireless router was connected LAN-to-LAN to improve coverage but remained in router mode. One laptop received the main router’s gateway; another received the spare router’s gateway. After the owner backed up both configurations, the spare unit was placed into its supported access-point mode, the test clients renewed their leases, and both converged on the main router’s DHCP settings.
Costly business example: an office sees intermittent failures and assigns static addresses to every affected PC. The symptoms quiet down, but phones and new devices continue receiving bad leases. The competing server remains active, documentation becomes inconsistent, and the next staff change triggers another outage. The better response is to identify and remove the unintended authority, then restore controlled automatic addressing.
Related The IT Guys guides
- Connected but No Internet? A 169.254 Address Points to DHCP, Not a Dead Laptop
- Printer or Camera Keeps Going Offline? Fix Its IP Address Without Creating a Conflict
- Remote Access Broke After a Router Upgrade? Check Double NAT and CGNAT
- Back Up Your Router or Firewall Configuration Before You Need It
FAQ
Does a second DHCP server always mean someone hacked the network?
No. “Rogue” describes an unauthorized server, not necessarily a malicious one. Old routers, lab equipment, virtual machines, and misconfigured access points can create the condition accidentally. Investigate first; do not turn a configuration mismatch into an unsupported breach claim.
Why do only some devices fail?
DHCP permits more than one server to offer configuration, and a client selects a server from the offers it receives.[3] Different clients can therefore end up with different configuration sources when an unintended responder is present.
Will rebooting the main router fix it?
It may temporarily change which DHCP offer a client selects, but it does not remove the unintended responder.[3] Compare DHCP Server, gateway, DNS, subnet, and lease data before and after a controlled isolation test.
Should I disable DHCP on the second router?
Only after confirming another intended DHCP service remains online and after checking the exact model’s supported access-point procedure.[5] Manufacturers warn that disabling DHCP without another server can leave clients needing manual addressing.[6]
When should I call for help?
Stop if the network carries payment systems, phones, cameras, alarms, medical or regulated data, multiple VLANs, managed switches, site-to-site VPNs, intentional DHCP redundancy, or undocumented business-critical equipment.
What to do next
Run one reversible comparison now: on one working Windows PC and one failing Windows PC, save the active adapter sections from ipconfig /all. Compare the DHCP Server and Default Gateway lines first. If they differ on the same intended LAN, preserve the network configuration and trace the unexpected address before resetting or replacing hardware.