DHCP woes

[Gareth1978]

One of our networks has gone a bit mad. The workstations are picking up IP addresses that are not issued by our DHCP server and are in fact nothing to do with our Organisation at all. As a result everything is grinding to a hault.

I've killed our connection to the outside world to see if I can persuade things to return to normal but its not going very well.

When I run a trace on the IP that is assigning the DHCP addresses it belongs to the Internet Assigned Numbers Authority in America.

Please can anyone advise me.

Thank you

**One day, I will find a question that no one else has answered........and will also know the answer to it ! **

 

[GlenJohnson]

Might want to post a little more info. What are the ip addresses being given out? Anything in you logs? Error messages? Good luck.

Glen A. Johnson
If you're from Northern Illinois/Southern Wisconsin/Central Florida feel free to join the Tek-Tips in Chicago, Illinois Forum.
TTinChicago
Johnson Computers

 

[mattKnight]

Gareth ....

I strangley had the same problem this week. Where your rogue IPs in the range 179.22.x.x?

I finally resolved these - one of our partner agencies had had their data network routed over our internal network, instead of over a seperate infrastructure. My resolution was to re-route them.

However, I have an extra question, given that I have a DHCP server on my LAN (100MB all round 1GB backbone) how come I get IPs allocated from server that is located at the other end of a 128K link. I would have thought that the local DHCP would have replied to the DHCP request quicker as it is local. Does this point to network bottleneck?

Take Care

Matt
If at first you don't succeed, skydiving is not for you.

 

[dearingkr]

If your rogue IP addresses are 192.168.0.x or 192.168.1.x, then it's very possible one of your users brought their own device in from home (maybe a linksys wireless AP?).

Another possiblilty is that one of your PCs is running a DHCP Server program.

It's frustrating. I've had both of these happen to me.

Here's a test you could try...
1. Find a PC that has one of those rogue IP addresses
2. Open a DOS window
3. Ping it's default gateway, i.e. 192.168.1.1
4. run arp -g to get the MAC address

The first 4 hex digits signify the manufacturer of the NIC
For instance:
00-0d is D-Link
00-A0 is Intel

Let me know if this helps.


MCSE CCNA CCDA