Unknown outside server doing our dhcp

[orman]

This is the 2nd time in 2 weeks that this is happenning. Our dhcp server assigns addresses 10.100 type. We have found an object- assuming a server- with address 172.16.50.1 (gateway) is acting as our dhcp server and giving out 172.16 type addresses. We do NOT have any wireless connections on the network and we do not have any servers with 172.16 addresses. How can this be????? We know the host name, butlersomething.com.
Any ideas what might be happenning & what we should do?

(We have a Windows 2003 network with Exchange - didn't exactly know which forum to post this.)

 

[orman]

It looks like it is inside the network and not outside, because we can ping the address internally but not externally.

 

[AllUserNamesAreTaken]

Well, the 172.X range is a private network designated by the RFC complaince or whatever it's called.

Basically, 172.X is an unroutable address, so it must be an Internal PC. Just go out and check all your static IP's on each machine.

 

[NewNetworkAdmin]

I had a similar problem with my home network. I had an ADSL router that connected the network to the Internet and acted as a DHCP server. I then found an old ADSL modem with 4 Ethernet ports that I wanted to use as a switch so I just plugged it in. Unfortunately as the second ADSL box was also a DHCP server the 2 boxes started 'arguing' and we had all sorts of problems with PCs not being able to talk to each other.

I would suggest as AllUserNamesAreTaken said that you check the IP addresses of all PCs and check any new devices that you've plugged in to make sure they're not trying to be DHCP servers.

Andy

 

[pagy]

In either the XP support tools or 2003 support tools (I forget which) there is a tool called dhcploc. This will find any DHCP servers on your network.

 

[58sniper]

ping -a 172.16.50.1
might tell you the host name.

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)

 

[orman]

Thanks all!!
I'll let you know what we find.

 

[Davetoo]

I thought that within a domain, if a DHCP server wasn't authorized, that clients of the domain wouldn't poll it for an IP address? Isn't that the whole reason for having to authorize a DHCP server in the first place?


I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.

 

[58sniper]

That's not true. Authorizing just means it has the AD authority to serve addresses. A DHCP device does a broadcast for an address, and any running DHCP server can respond. That has nothing to do with AD/authorization.

Pat Richard, MCSE(2) MCSA:Messaging, CNA(2)

 

[Davetoo]

Thanks.

Another thing you can do, if all else fails, to find the rogue DHCP device is to search your swithces for it's MAC and track it down that way...tracert to it then check your ARP table to obtain the MAC.

I'm Certifiable, not cert-ified.
It just means my answers are from experience, not a book.