DHCP assigning bad addresses

[rick1968]

Hello all. I have a server running win 2000 server sp4 and dhcp. Lately , the dhcp server is handing out 192.168 instead of 172.16. This happens at random places in the facility and is not confined to one switch or group. The problem is easily fixed with an ipconfig release / renew , but is beginning to become rather annoying.Is this actually the dhcp or could it be something else? Thanks and any help is appreciated.

 

[kmills]

rick1968,

Are you sure it is THAT server handing out the 192.168. addresses? Is there any possibility you have another device doing DHCP on the same network?

kmills

 

[lhuegele]

That's my guess. You should use a packet sniffer to see what DHCP servers are in your environment.

We saw the same thing happen when our DHCP server died and everyone started getting IP's from the phone systems DHCP server.

Because DHCP is a broadcast protocol, the first DHCP server that responds will be the one issueing the IP address.

Another idea to find out if you have another DHCP server is to shut down your DHCP server. Then from a test machine, do a /renew. Then do an ipconfig /all to see what the address of your DHCP server is. Then you can try to trace that machine down and get it off your network.

Good luck,

 

[rick1968]

NO. We used to have another dhcp server about 7 years ago but I have verified that it is shut down.

 

[Freestone]

We had a similar problem at a site which was found to be a wireless router brought in from home.

 

[Freestone]

Actualy the wireless had nothing to do with it....it was was someone trying to get more than one LAN drop in his office so he was using the wired section of the router without realizing that the router was dishing out DHCP too.

 

[rick1968]

I like the router idea. I didn't think about that.I know we have several access points but I am unaware of any routers. Like yours though , someone might have brought one in.I'll start looking for that first thing.Of course I'm still finding things on the network I didn't know were there that were pushed to the back burner but may still be on.Thanks.

 

[markdmac]

The next time it happens, run IPCONFIG /ALL to display which DHCP server issued the address. That will at least get you an IP to start with.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[juniper911]

I just want to add to markmad's point, when you find out the IP address of this other DHCP server, ping it and then check the mac address of the device using the arp command. then use a site like

http://www.coffer.com/mac_find/

and it can tell you what the manufacturer is. Just knowing the IP address might not be enough in knowing what/where it is...

I had the same problem and it was device that I had nt even thought of that was handing out address's!!!

 

[lhuegele]

We had this problem when someone in a conference room plugged a switch into both our data and our voice networks. They just saw ports and started plugging everything into the switch trying to get internet access in the conference room.

What that caused was a bridge between our voice network (IP based) and our data network, so some machines were getting IP's from the voice network. Now that was fun tracking down.

No matter what, it still sounds like you have another DHCP server somewhere on your network. Hope you find it.

 

[Titleist]

Also check that someone hasn't installed VMWare workstation on thier PC. If the netwoking portion is not setup properly it can act as a DHCP server. It took me awhile to track that one down....

 

[kmcferrin]

I agree, it's most likely a rogue DHCP server of some sort. IPCONFIG /ALL will tell you what its IP is.

 

[rick1968]

I had six of these occurrences yesterday alone. I pinged the dhcp server at 192 .168.1.254 as advised and received no reply.I definitely believe there is a rogue machine out there somewhere and it is doing this intermittently.I checked into this VMware software and there are are only a few people that would use something like that and they are in my dept.and I'll chat with them today. We are going to be looking at all our hardware starting today going from the bottom up. With hundreds of machines this is going to be fun.Thanks and I'll keep you posted.

 

[lhuegele]

If you have VLAN's and/or managed switches, you might be able to track down which port this machine is on.

Good luck,

 

[oisnds]

192.168 addresses are automatically generated whenever MS can't connect to a valid DHCP server. Could be network connection or any of the other mentioned possiblities. I would start with the hardware and work out from one of the PCs haveing the problem.

 

[markdmac]

APIPA addresses start with 172 not 192.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.

 

[Freestone]

I don't like disagreeing with Mark but APIPA addresses start at 169.

http://support.microsoft.com/kb/220874

Dell

 

[markdmac]

You are absolutely correct Freestone. Thanks for correcting me. Not sure what I was thinking.

I hope you find this post helpful.

Regards,

Mark

Check out my scripting solutions at

http://www.thespidersparlor.com/vbscript

Work SMARTER not HARDER. The Spider's Parlor's Admin Script Pack is a collection of Administrative scripts designed to make IT Administration easier! Save time, get more work done, get the Admin Script Pack.