General discussion

Locked

IP Address NACK

By daniel ·
We recently started receiving messages in the event log of the PDC at our main location stating "The DHCP server issued a NACK to the client for address 10._____ request ______. However, I am unable to locate that IP address on the network to see what device is causing this. I am assuming the 10.__.__.__ address is a local network address, however, it also appeared on another of our LANs that isn't connected to our main location. We all use the same data processor, but I do not know why a 10.__.__ address would be attempting to get an address from DHCP.

First of all, any possible explanation to this, and second, how would I temporarily exclude this address so Event log wont get filled up with these messages (approx. every 2 minutes there is an entry). Since that address is not in the scope I cannot exclude it. I think there may be a way to add the station so this wont happen, although I am unsure how to do it.

Thanks,

Dan Buonocore

This conversation is currently closed to new comments.

5 total posts (Page 1 of 1)  
| Thread display: Collapse - | Expand +

All Comments

Collapse -

IP Address NACK

by hstahl In reply to IP Address NACK

My first thought was that you had a user w/ a laptop that has a cable modem or DSL at home and that's where the NACK's were coming from. However, that should only happen once a day for that user, not every 2 minutes. That makes me wonder if you have a defective NIC somewhere. Its most likely not on one of your computers or a user would complain of no connectivity, perhaps a hub or switch that grabs an IP for management purposes is doing it? Could be anything attached to the network really.

I would use some kind of protocol analyzer (sniffer) on the same network segment as the DHCP server is on (so it see the traffic the DHCP server is receiving/sending). Do a capture and see if you can find the DHCP request and the subsequent NACK. From the capture you can get the MAC address of the culprit, that could help you track it down.

Also, I wonder if your routers are incorrectly setup to pass DHCP requests? That could explain a lot, such as why its showing up in a LAN across your WAN. Perhaps DHCP requests are coming from outside your network via the Internet.

Another way to catch the device doing this would be to pull segments off your network and see if the requests keep coming. The usefulness of this will depend onyour network topology, but if there are multiple switches/hubs out there it could help.

One last thought is that you have a loop in your network that is causing this DHCP request to "never die." I don't think that's very likely, as it should flood the network, not just happen every 2 minutes, but its one more avenue to investigate.

-Heath

Collapse -

IP Address NACK

by daniel In reply to IP Address NACK

Poster rated this answer

Collapse -

IP Address NACK

by turambar386 In reply to IP Address NACK

Hi Dan. Just a couple of thoughts.

It's possible that the device requesting a DHCP license may not be a PC. Routers, switches, and even intelligent hubs (not to mention printers) can be programmed to use BOOTP/DHCP. I think that Synoptics equipment is often set up by default to try to use BOOTP.

Does the event log error give you a MAC address? If so, you can look up the first few digits and see what the equipment manufacturer is.

The other thought is that prior to service pack 4, DHCP was pretty crummy. If you are using < SP4, upgrade!

Collapse -

IP Address NACK

by daniel In reply to IP Address NACK

Poster rated this answer

Collapse -

IP Address NACK

by daniel In reply to IP Address NACK

This question was closed by the author

Back to IT Employment Forum
5 total posts (Page 1 of 1)  

Related Discussions

Related Forums