TechRepublic passport owner Mick Rielly submitted the topic for this pop quiz, and we sent him a cool TechRepublic T-shirt. If you’d like to suggest a topic for an upcoming pop quiz, please send us a note.

The situation:
Here’s the problem Mick described: “After installing DHCP (Dynamic Host Configuration Protocol) on the network, duplicate IP addresses were being assigned at morning log on. So we decided to manually account for IP addresses and remove DHCP services. However, DHCP appears to still reside somewhere on the network. Occasionally, DHCP error messages appear on end user GUIs. Also, Hewlett-Packard LaserJet direct print servers automatically assign themselves IP address once connected to the network.”

The challenge:
Are the print servers still using DHCP? Is there a DHCP ghost residing on the network?

The solutions:
We received nearly 100 possible solutions to this pop quiz. Special thanks go to John Sheesley, technical editor for TechProGuild, for helping sort through the e-mails.

Run winipcfg or ipconfig
From Eric Spencer, Computer Support: “Based on what Mick wrote, the print servers are still using DHCP, but only as clients. Is there a DHCP ghost residing on the network? You have another DHCP server residing somewhere on your network that happens to be handing out the same IP range. DHCP works by the client sending a request packet out across the network and the server responding. You didn’t mention how large your organization is (or what kind of equipment you have available) but my advice would be to:

  1. Set up a Windows 95/98 (NT would work as well) box somewhere with DHCP on the network.
  2. After the box obtains an IP, run winipcfg (ipconfig from a console window in NT).
  3. Note the IP address of the DHCP server.
  4. Use whatever network software/layout that you have available to track down the location of the DHCP server IP address, OR block that IP with your router and wait till someone complains.

Note: The DHCP server itself is not configured for DHCP IP allocation.”

Check DHCP error messages
From Stan Craigie: “Presumably, if you’ve removed DHCP, then you have assigned every workstation a static address. The only way an end user will receive a DHCP error message is if it does not receive a response to its DHCP request, so some must still be set for DHCP, no? I’m assuming the HPs are printers with JetDirect cards installed. You would normally assign a printer a static address so that you could always find it. The assignment of duplicate addresses with DHCP would be accounted for by some static addresses still existing on workstations—printer addresses not being excluded from the DHCP scope—more than a single DHCP server having overlapping scopes.”

Check the lease time of the IP addresses
From Keith Singleton, CTO: “This issue is most likely related to the lease time of IP addresses. This may be compounded by a combination of static IP addresses and DHCP clients. If the static IPs are not included in an excluded ‘range’ on DHCP, then the DHCP server may attempt to assign the static IPs. Simply make sure that ALL network IP-addressable devices are set to use DHCP and that the lease time is increased to something more reasonable, such as 30 days.”

From Dave Packman: “With older DHCP servers, the clients would hold leases after they expired unless they were rebooted. Make sure all client systems are reset or powered off at night. One thing to try is setting up static IP addresses for all of your clients in DHCP, and then tracking down any remaining address conflicts by changing the DHCP static IP address for the affected system. Also, check the printer configurations to make sure they are all pointing to the correct address to your DHCP server.”

TechRepublic passport owner Mick Rielly submitted the topic for this pop quiz, and we sent him a cool TechRepublic T-shirt. If you’d like to suggest a topic for an upcoming pop quiz, please send us a note.

The situation:
Here’s the problem Mick described: “After installing DHCP (Dynamic Host Configuration Protocol) on the network, duplicate IP addresses were being assigned at morning log on. So we decided to manually account for IP addresses and remove DHCP services. However, DHCP appears to still reside somewhere on the network. Occasionally, DHCP error messages appear on end user GUIs. Also, Hewlett-Packard LaserJet direct print servers automatically assign themselves IP address once connected to the network.”

The challenge:
Are the print servers still using DHCP? Is there a DHCP ghost residing on the network?

The solutions:
We received nearly 100 possible solutions to this pop quiz. Special thanks go to John Sheesley, technical editor for TechProGuild, for helping sort through the e-mails.

Run winipcfg or ipconfig
From Eric Spencer, Computer Support: “Based on what Mick wrote, the print servers are still using DHCP, but only as clients. Is there a DHCP ghost residing on the network? You have another DHCP server residing somewhere on your network that happens to be handing out the same IP range. DHCP works by the client sending a request packet out across the network and the server responding. You didn’t mention how large your organization is (or what kind of equipment you have available) but my advice would be to:

  1. Set up a Windows 95/98 (NT would work as well) box somewhere with DHCP on the network.
  2. After the box obtains an IP, run winipcfg (ipconfig from a console window in NT).
  3. Note the IP address of the DHCP server.
  4. Use whatever network software/layout that you have available to track down the location of the DHCP server IP address, OR block that IP with your router and wait till someone complains.

Note: The DHCP server itself is not configured for DHCP IP allocation.”

Check DHCP error messages
From Stan Craigie: “Presumably, if you’ve removed DHCP, then you have assigned every workstation a static address. The only way an end user will receive a DHCP error message is if it does not receive a response to its DHCP request, so some must still be set for DHCP, no? I’m assuming the HPs are printers with JetDirect cards installed. You would normally assign a printer a static address so that you could always find it. The assignment of duplicate addresses with DHCP would be accounted for by some static addresses still existing on workstations—printer addresses not being excluded from the DHCP scope—more than a single DHCP server having overlapping scopes.”

Check the lease time of the IP addresses
From Keith Singleton, CTO: “This issue is most likely related to the lease time of IP addresses. This may be compounded by a combination of static IP addresses and DHCP clients. If the static IPs are not included in an excluded ‘range’ on DHCP, then the DHCP server may attempt to assign the static IPs. Simply make sure that ALL network IP-addressable devices are set to use DHCP and that the lease time is increased to something more reasonable, such as 30 days.”

From Dave Packman: “With older DHCP servers, the clients would hold leases after they expired unless they were rebooted. Make sure all client systems are reset or powered off at night. One thing to try is setting up static IP addresses for all of your clients in DHCP, and then tracking down any remaining address conflicts by changing the DHCP static IP address for the affected system. Also, check the printer configurations to make sure they are all pointing to the correct address to your DHCP server.”

There’s another DHCP server with a backup
From Mark Bloxham: “I think that maybe one of your routers is acting as a relay agent for DHCP, and a DHCP server on another network has a backup range of addresses for your network.”

From Maxim H. Weinstein: “It sounds possible that a switch or router connected to the local subnet is configured to pass DHCP broadcast packets. This means that a DHCP server on another segment or subnet, or perhaps even on the Internet, could be ‘hearing’ the requests and providing IP addresses to the clients. An indication of this would be if the IP addresses received by clients are incorrect for the subnet.

“Another cause of something like this could be a DHCP Relay Agent installed on a DHCP server on the local subnet. Check the services list of all servers.”

Could be a ghost
From Manny Aggarwal: “Here is my take: If the print servers are automatically assigning themselves IP addresses, they are still using DHCP, and if they can successfully get an IP address, then there is definitely a ghost DHCP server running in the network. The reason duplicate addresses were being assigned can also be attributed to that ghost DHCP server nobody knows about. The scope must have been overlapping in the two servers. The ghost may well be in the form of a mis-configured RAS server.

“To resolve the problem, you might try this approach. Configure one workstation to use DHCP IP address. Go to a DOS prompt and use ipconifg /all to view the detailed IP settings. Here you will see the IP address of the DHCP server. Resolve the IP address to the host name and nail the sucker!”

Use the NT Resource Kit’s Dhcploc utility
From Michael D. Smith, MIS/Network Manager: “He needs to use the Dhcploc utility from the NT Resource Kit to find all DHCP servers that are on the network. This utility will detect all DHCP servers on a subnet (both legitimate and renegade).

“In a WAN environment, it would be wise to check the routers to see if a DHCP helper address has been set to direct DHCP broadcasts to a remote location. In order for this situation to be valid, the remote location would also need to be running a DHCP server with a scope for the incoming subnets.

“Also, the situation indicated that it appeared that DHCP was still operational. He needs to keep in mind that the computers will retain the IP address information for the duration of the lease. Therefore, if there was a long lease duration, it may appear that DHCP is still active.”

If you reinstall DHCP…
Of course, Mick uninstalled DHCP and didn’t want to reinstall it. However, we received a couple of good suggestions for troubleshooting DHCP problems while DHCP is installed.

From Ken Parr: “The best way of finding out what PCs or printers are still using DHCP is to run DHCP Admin. (Of course, if Mick has removed DHCP, he couldn’t do this.) Configure the utility to point to the DHCP server and look at the Active Leases. Doing so will show the IP address and the computer name still using DHCP. Mick will then be able to go around and disable DHCP on the printers and PCs that are listed in DHCP Admin.”

From Paul Therriault: “Mick, I don’t think you have a DHCP ghost on your network. Nor do I think your HP Laser Printers are receiving their address via DHCP. As for the client workstations with the ‘No DHCP Server Found’ message, it’s likely that they are still configured for DHCP instead of having a static IP. Here’s what you need to do:

  • Make sure your DHCP server has a static IP address.
  • Create a scope on your DHCP server.
  • Activate the scope.
  • Exclude a range of addresses from the scope that will be used for your servers. I usually exclude 1 through 20.
  • Assign one of the excluded IP addresses to each of your servers and HP Jet Direct boxes, and then reboot them.
  • At each client workstation, go to the Network, Control Panel Properties page and configure them to Obtain an IP address automatically, and then reboot them.”

To select our winner, we put the names of everyone whose solution we published in a hat. Then we selected one winner at random. (We sent the others a TechRepublic T-shirt.) Congratulations and a $25 gift certificate to Fatbrain go to Keith Singleton. To comment on these solutions, please post your remarks below or send us a note.
There’s another DHCP server with a backup
From Mark Bloxham: “I think that maybe one of your routers is acting as a relay agent for DHCP, and a DHCP server on another network has a backup range of addresses for your network.”

From Maxim H. Weinstein: “It sounds possible that a switch or router connected to the local subnet is configured to pass DHCP broadcast packets. This means that a DHCP server on another segment or subnet, or perhaps even on the Internet, could be ‘hearing’ the requests and providing IP addresses to the clients. An indication of this would be if the IP addresses received by clients are incorrect for the subnet.

“Another cause of something like this could be a DHCP Relay Agent installed on a DHCP server on the local subnet. Check the services list of all servers.”

Could be a ghost
From Manny Aggarwal: “Here is my take: If the print servers are automatically assigning themselves IP addresses, they are still using DHCP, and if they can successfully get an IP address, then there is definitely a ghost DHCP server running in the network. The reason duplicate addresses were being assigned can also be attributed to that ghost DHCP server nobody knows about. The scope must have been overlapping in the two servers. The ghost may well be in the form of a mis-configured RAS server.

“To resolve the problem, you might try this approach. Configure one workstation to use DHCP IP address. Go to a DOS prompt and use ipconifg /all to view the detailed IP settings. Here you will see the IP address of the DHCP server. Resolve the IP address to the host name and nail the sucker!”

Use the NT Resource Kit’s Dhcploc utility
From Michael D. Smith, MIS/Network Manager: “He needs to use the Dhcploc utility from the NT Resource Kit to find all DHCP servers that are on the network. This utility will detect all DHCP servers on a subnet (both legitimate and renegade).

“In a WAN environment, it would be wise to check the routers to see if a DHCP helper address has been set to direct DHCP broadcasts to a remote location. In order for this situation to be valid, the remote location would also need to be running a DHCP server with a scope for the incoming subnets.

“Also, the situation indicated that it appeared that DHCP was still operational. He needs to keep in mind that the computers will retain the IP address information for the duration of the lease. Therefore, if there was a long lease duration, it may appear that DHCP is still active.”

If you reinstall DHCP…
Of course, Mick uninstalled DHCP and didn’t want to reinstall it. However, we received a couple of good suggestions for troubleshooting DHCP problems while DHCP is installed.

From Ken Parr: “The best way of finding out what PCs or printers are still using DHCP is to run DHCP Admin. (Of course, if Mick has removed DHCP, he couldn’t do this.) Configure the utility to point to the DHCP server and look at the Active Leases. Doing so will show the IP address and the computer name still using DHCP. Mick will then be able to go around and disable DHCP on the printers and PCs that are listed in DHCP Admin.”

From Paul Therriault: “Mick, I don’t think you have a DHCP ghost on your network. Nor do I think your HP Laser Printers are receiving their address via DHCP. As for the client workstations with the ‘No DHCP Server Found’ message, it’s likely that they are still configured for DHCP instead of having a static IP. Here’s what you need to do:

  • Make sure your DHCP server has a static IP address.
  • Create a scope on your DHCP server.
  • Activate the scope.
  • Exclude a range of addresses from the scope that will be used for your servers. I usually exclude 1 through 20.
  • Assign one of the excluded IP addresses to each of your servers and HP Jet Direct boxes, and then reboot them.
  • At each client workstation, go to the Network, Control Panel Properties page and configure them to Obtain an IP address automatically, and then reboot them.”

To select our winner, we put the names of everyone whose solution we published in a hat. Then we selected one winner at random. (We sent the others a TechRepublic T-shirt.) Congratulations and a $25 gift certificate to Fatbrain go to Keith Singleton. To comment on these solutions, please post your remarks below or send us a note.