The Coaching Centre Wi-Fi That Ran Out of Addresses
Bright Path Coaching Centre has one consumer Wi-Fi router serving 60 students, 12 staff, four IP cameras and a small NAS holding fee records. There is a single SSID, 'BrightPath_Guest', with one WPA2 password that has not changed in two years; WPS is enabled and the router firmware is from 2019. The DHCP pool is set to 192.168.1.100–192.168.1.150. Between 4 and 6 p.m., students report that pages take 15–20 seconds to load, the camera feed in the office freezes, and the fee clerk cannot open the NAS. The router's admin page is reachable at 192.168.1.1 from any connected laptop and still uses the default admin password. The owner sees several unknown devices in the client list, including 'android-9f2c' and 'ESP_4A11', and asks whether simply raising the DHCP range to .100–.200 will fix everything.
1. From the symptoms, identify the two most likely technical causes and explain the evidence for each.
Read the worked answer
Cause 1: address-pool exhaustion and uncontrolled client numbers. The DHCP pool has 51 usable addresses for 60 students plus 12 staff plus cameras and NAS, and the peak is 4–6 p.m. When the pool is exhausted, new devices fail to obtain an address or self-assign one, and the router's DHCP service struggles. The owner's unknown devices show that the client list is not controlled, which makes exhaustion worse.
Cause 2: a flat, unsegmented network with weak access control. Every device-student laptops, cameras, NAS and staff-is on one broadcast domain. The fee clerk cannot open the NAS because the NAS is saturated, misaddressed, or being reached by too many clients. The camera feed freezes because wireless airtime is shared and one heavy client or interference can starve the cameras. The default admin password and enabled WPS mean an unauthorised user may already have changed settings or joined the network; 'ESP_4A11' looks like an IoT device that nobody has accounted for.
Raising the pool to .200 would only hide the address shortage. It would not remove unknown clients, fix the flat network, or protect the NAS. The symptom pattern points to capacity plus access-control failure, not a single DHCP bug.
2. Propose a redesigned network with three separate logical zones and the specific settings you would change, in priority order.
Read the worked answer
Zones:
- Staff/fee VLAN: fee clerk, office PCs and NAS; restricted access and no student devices.
- Student/guest VLAN: student laptops and phones; client isolation and a bandwidth cap so one user cannot starve the cameras.
- IoT/camera VLAN: cameras and DVR only; no direct internet access except to the vendor cloud if required, and no route to the fee VLAN.
Priority order:
- Remove immediate takeover risk: change the router admin password, disable WPS, disable remote administration from the WAN, and update firmware. These are free and take minutes.
- Separate the zones: create VLANs on a managed switch or use the router's guest-network and AP-isolation features if budget is tight. Add firewall rules that deny traffic between student, staff and camera zones.
- Fix addressing and authentication: enlarge the DHCP pool only after segmentation, shorten lease time for guests, use a unique guest password or a captive portal, and give staff a separate SSID with WPA2-Enterprise if possible.
- Monitor: enable logging, record known MAC addresses, and review the client list weekly.
The order reflects risk: default admin access and WPS can be exploited in minutes, while segmentation takes longer but limits blast radius.
3. The owner says the centre cannot afford managed switches. Give one low-cost measure that still reduces risk and state its limitation.
Read the worked answer
Measure: use the router's built-in guest network with AP/client isolation for students, and keep staff, the NAS and the cameras on the main network. Change the guest password regularly and cap guest bandwidth. This is often a single checkbox and no new hardware.
Limitation: the guest network is still handled by the same consumer router, so a router compromise or a firmware flaw can bridge the zones. There is no real inter-zone firewall, no VLAN-level logging, and the cameras and NAS still share the main network with staff. Client isolation also does not stop a determined attacker on the same wired segment. It reduces casual snooping and airtime contention, but it is not equivalent to VLAN segmentation. Treat it as a temporary control while budgeting for a managed switch or a small business router with VLAN support.