We use Microsoft DHCP in our environment and this morning began to get flooded with bad_address leases. The server issued lease after lease every 12-13 seconds and they all showed bad_address in the name field of the lease table. The odd thing we noticed was that the Unique ID (MAC address) field was incomplete. Rather than 6 bytes of data, we were only seeing 4 bytes. Also noteworthy is that the last 2 bytes were the only constant:
f121670a
ed20670a
a1be670a
A new unique ID was generated every 12-13 seconds. We deleted the bad_address(es) in bulk every 5 minutes to prevent scope exhaustion. Before we were able to get a sniffer connected, the pattern stopped.
I remember hearing something about Macs running IPv6 not playing well with Microsoft DHCP.
Does anyone else have any other ideas?