Networks

Ask something
Question Locked

Windows 2003 server (std) DHCP sometimes assigns incorrect IPs

0 helpful
25 replies

by wil_tmp

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.

I have a windows 2003 server (standard) providing DHCP/DNS/Wins services to a small network with a IP address of 192.168.1.50

internal user IP range is 192.168.1.100 to 192.168.1.150, with each machine being assigned a fixed DHCP IP based on MAC Address.

A Linksys router acts as the default gateway with DHCP being disabled on it (the W2k3 DHCP server passes the default gateway/DNS/Wins to the DHCP clients)

Sometimes, a machine will loose its fixed DHCP address and will be assigned something like 192.168.1.2; but the DNS/WINS will be correct and point to 192.168.1.50)

Usually there will be no record of this in the DHCP log (sometimes I'll see the client machine making quite a few requests later on for the 192.168.1.2 and then get assigned the correct IP).

Its like the DHCP service hickups and looses track?

Any one else seen anything similar, and know of why, and if there's something that can be done.

Aside: I think its alternate DHCP server, or a Windows 2003 Standard issue. I also baby sit a similarly configured Windows 2003 SB server which doesn't assign screwy IP addresses (theres a dlink as the default gateway).. Its the fact that the DNS, and wins information is correct which makes me think its something to do with the Windows 2003 server

Thanks

Paul

25 replies

by scott_heath

... when you run IPCONFIG /ALL it will give the IP address of the device it got it's IP from.

Then go find it and DESTROYYY!!!! ARGGGGHHHH!!!

Good luck! ;)

by wil_tmp

Doh.. Should of thought of that (DHCP Server...) to identify the DHCP server source .. lol

I've checked the machine, and it has the correct DHCP server and IP address... So I'm going to have to wait and then pounce the next time it happens

Thanks

Paul

by wil_tmp

Just an update. The issue seems to be with windows 2003 server itself as its replying back twice to any DHCP requests

I've used a tool called DHCPLOC to confirm this

C:\WINDOWS\system32>dhcploc 192.168.1.102
11:20:02 OFFER (IP)192.168.1.190 (S)192.168.1.21 ***
11:20:03 OFFER (IP)192.168.1.3 (S)192.168.1.21 ***

Note the 192.168.1.190 reply is correct

I was playing with the scope to see if I could get a different response from the DHCP server (Used 192.168.1.1-192.168.1.254 with excludes, and then 192.168.1.190-192.168.1.210 with no excludes)

Going batty; but at least it aint a rouge dhcp server

Paul

by wil_tmp

Got it

Wingate VPN was installed on the machine before it went into production (about 4 months ago)

The Wingate DHCP service was still running in addition to the MS DHCP server

Both replying to DHCP requests. DHCP client takiing 1st response

80% of the time, the MS DHCP service responded 1st

All Wingate VPN serviced disabled and software removed.

Works a expected

Doh!

Paul

by maniacman

Go the properties of the DHCP server and ensure that this option is set.

by wil_tmp

Hi ManiacMan

Any idea where that setting would be.. I've never seen that setting before, and couldn't locate just now.. The closest I could find is "Conflict Detection Attempts" which I believe does the same thing (which is set to 3)

Thanks

Paul

by maniacman

But I still can't see how your DHCP server could be assigning duplicate addresses unless the scope itself is somehow corrupted.

by wil_tmp

K, it happened again yesterday

The IP of the DHCP Server is correct (see below)

Default gateway is incorrect (but packets are being routed through the 2k3 machine to the default gateway of .1

So leaning towards the W2k3 box...

Going to have to setup a trace of all DHCP requests and see if that'll shed any light

Paul

Physical Address. . . . . . . . . : 00-11-09-D4-B6-09
Dhcp Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IP Address. . . . . . . . . . . . : 192.168.1.2
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 192.168.1.21
DHCP Server . . . . . . . . . . . : 192.168.1.21
DNS Servers . . . . . . . . . . . : 192.168.1.21
Primary WINS Server . . . . . . . : 192.168.1.21
Lease Obtained. . . . . . . . . . : Tuesday, December 18, 2007 7:28:17 AM
Lease Expires . . . . . . . . . . : Saturday, February 16, 2008 7:28:17 AM

by cg it

so #1 understand that.

second is that DHCP assigns addresses from a range you specify. So if you specified 192.168.1.100-150 as the range, authorized this scope, then DHCP should NOT assign clients an address outside of that authorized scope.

third is, DHCP has a span of time it issues addresses. the default is 7 days. now about half way through that period of time DHCP clients start the renew processes. If at any time between the time the renewal process starts and the renewal process end [7days] the client computer isn't on the network for the renewal, DHCP "might" assign that address to another computer. When the computer off line comes online, it would receive another address.

I haven't run into a problem with DHCP assigning addresses outside it's authorized scope. I have run into users changing the comps address to a static one, then when their done doing whatever, change back to auto discover where DHCP now knows that comp had a static and it shows up in DHCP.

by scott_heath

... the term he meant to use is "Reserved", which one can do with a MAC address. The IP I am using right now is reserved for my MAC so that I can maintain the use of DHCP on my PC but always receive the same IP address.

I agree that it cannot assign addresses outside of it's scope, or at least I have never seen it happen in 7 years. And lease times aren't even a convern when using reserved IPs because it always gets the same IP no matter how long it has been off the network.

This is most likely a rogue DHCP server. Some user may have brought in a wireless router thinking it would be cool to have wireless in his cube, not realizing the damage it can do to the network.

If you want to find it REALLY bad you could wait until everyone is gone, stop the DHCP server service, then release and renew the IP on a system that has had the problem. If it picks one up then... VIOLA!! You can go find it.

by cg it

made it sound like "reserved" addresses were being ignored and an out of range address is being assigned. I've never seen DHCP ignor a reserved address for a host, especially if one is using MAC addresses and on top of that, then decide to give that host an address that isn't even in the authorized scope.

Sounds to me like someone is messing around with the addresses or the TCP/IP settings.

by wil_tmp

Hi ManiacMan

No duplicates assigned. Just non approved IP assigned with no entries in the DHCP logs (which may be an issue with W2k3 server or a rouge DHCP server)

Waiting for it to happen again so I can see what is the assigning DHCP server

Thanks for your reply

Paul

by wil_tmp

Hi CGIT

Sorry, using the wrong my definition for the IP assignement (fixed verses reserved)

I'm using dns reservations to assign the same IP address to a machine based on its MAC address (so its not fixed at the client but is fixed at the DHCP server)

The addresses assigned are outside of the available open assigned scope (but in the same subnet)

Heres a ruff layout of how IP are assigned

.1 Gateway
.20 to .40 servers
.50 to .70 Print servers, photo copier, phone system
.100 to .150 assigned user IP based on mac (DHCP Reservations)
.160 to .180 DHCP assignment range for Newly unknown machine assigned IPs

As per users changing IP addresses.. I've setup most of the users with non admin accounts without providing them with a admin user (so hopefully it aint user tweaking).

I'm leaning to either a rouge DHCP server, an issue with the W2k3 DHCP server (hot fix anyone :-), or something in my configuration of the DHCP server which isn't liked by w2k3

I've got another machine running W2k3 SBS in a different network with almost exact configuration, and the issue doesn't occur

Thanks for your replies

Paul

Note: The IP address of the server is actually .21 and not .50

by cg it

192.168.1.1-180?

with your reservation pool starting at 20 and runs through 70?

If this is the case then it's conceivable that DHCP might hand out an address that is not within the reservation pool [20-70] and be in the range 1-20 which is still within the authorized scope and does not conflict with reserved addresses.

by wil_tmp

I have 2 ranges of DHCP assignable IPs

.100 to .150 assigned user IP based on mac (DHCP Reservations Manually set up).

.160 to .180 DHCP assignment range for Newly unknown machine assigned IPs (this is my Authorized Scope Range based on right clicking, selecting properties of the base scope).

by cg it

well the only difference is that there is a wizard that configures DHCP for you and ha ha if you try to muck with it manually, it often will break and is a bear to fix.

However, again, there's no difference between DHCP on a W2003 Standard or even Enterprise edition and a SBS edition. For that matter, no difference in DNS, WINS, RRAS, Active Directory , etc as long as one remembers that SBS likes it's wizards and other flavors don't have em.

by dumphrey

But have you double checked the linksys router to be sure dhcp is disabled on it?

by wil_tmp

Hi Dumphrey

It was the the first thing I checked; but this does not necessarily mean that disabling it truly disables it (seen lots of software options which don't work as expected).

The Linksys DHCP could be coming up for a short period of time during a restart as and example (but that still doesn't explain the Wins and DNS settings on the client pointing to the correct machine)

Also from what I've seen with the Windows 2003 DHCP server (at least under the SBS edition and haven't tested this under standard) is that if anther DHCP server is active, then the W2k3 DHCP service wont start and throws some sort of event log (and maybe a popup)

I had a issue with a Wireless router with DHCP enabled at the start of 2007, and it was very obvious that another DHCP server was up and running.

Thanks for the reply

Paul

by dumphrey

should take pecedent over a rogue if you have dhcp authorized, and dns as AD integrated. But like you said, should and are are 2 different things. And your right, it doesn't explaine the ipconfig pointing to the right dhcp server. My next guess is either a corrupt scope or someone trying to gain access to data they shouldn't have. Do you have a sniffer on the wire? To see what type of traffic you are getting right around the bad addresses?

by scott_heath

The rogue DHCP server was configured by a half way intellient dude who configured it that way so his laptop would work wirelessly on the network. He may have set it up to bridge to the coporate network.

I have used Windows Server DHCP and DNS for 7 years and not seen this problem. I have a hard time believing the server would hand out an out of scope IP. Either someone doesn't understand the config or it's a rogue DHCP server.

by scott_heath

This is also why I never used 192.168.x.x for coporate network addressing. I used 10.x.x.x since home routers pretty much stay away from that range. let's you see rouge equipment brought by home users more easily.

by wil_tmp

I inherited this range

I usually use something in 192.168.240.x to 192.168.249.0 for the local segement

Planning to change at some point (just not ready for the pain that I had with another client and hard coded IP's all over the place)

Paul

by wil_tmp

There is actually one difference between the two scopes I've setup

I believe on the SBS machine I put the scope as all available IP's and then excluded the ranges which I didn't want to use for new IP assignments.

I was thinking it would be the same; but maybe this is the reason why the W2k3 Std DHCP is having issues sometimes.

Going to change the scope around and I'll post the results

Paul

This discussion is closed to new replies.