Networks

Ask something
Discussion Locked

DHCP Issue

0 helpful
14 replies

by chris.rodgers

Closed to new repliesThis discussion is closed. It stays readable, but it takes no new replies.
This is the wierdest thing I've ever seen, I run a network of about 130 PC's mostly on DHCP, on a bunch of machines there is a problem where every once in a while for no apparent reason the Subnet mask changes from 255.255.0.0 to 255.255.255.0 or 255.0.0.0. I've used Linux DHCP, Windows DHCP DHCP from a 3Com firewall and they all have the same problem. If you release then renew the address it comes back fine. The only thing that I've seen that the users have done before this happens is printing from excel but that is not always the case. I've checked numerous times for the existance of a second DHCP server but there is none. Anyway if you can help I would appreciate it.

14 replies

by timwalsh

Since you have tried multiple DHCP implementations to resolve this, DHCP itself can probably be discounted unless you made the same configuration error when setting up all three. In the Windows' implementation of DHCP, the subnet mask is configured during the creation of the scope and cannot be changed without recreating the scope.

With a problem like this, where there is no readily recognizable cause, you need to start looking for patterns.

Do all affected computers have problems at the same time?
Are all the affected computers running the same OS? If the affected computers are running WinXP, check and see if Alternate Configuration settings are set in TCP/IP properties.
Does the problem always occur at the same time or with a same frequency?

Do the affected computers receive the same IP address they previously had when a DHCP lease is renewed (this is usually the case unless the lease is received from a different DHCP server, or the computer was turned off for an extended period of time including its normal DHCP lease renewal period}? What is the length of your DHCP lease?

Have you always had this problem or did it start occurring recently? If it only started recently, what changed with the netwrok around the same time?

Are you running multiple scopes on your DHCP server? If so, are the subnet masks correct for all scopes?

You mentioned checking for other DHCP servers. How did you go about this?

When the subnet mask changes, do the affected computers in fact have IP addresss assigned from the correct IP range?

If you can pin down the problems to specific times, what do the event logs show for those times? Are there any errors listed in the system/application logs?
(continued)

by timwalsh

The next time you notice a scope change, immediately look in your DHCP tool and check if the affected computer has a registered lease, and if the DHCP server itself is still configured properly. Also run IPconfig /all on the affected computer and crosscheck the information related to DHCP server IP address, date/time the lease was obtained and when the lease expires. If doesn't match the information listed on your DHCP server, you probably DO have a rogue DHCP server someplace.

Hope something in here helps.

by carlos.nino

You say (some or most of the times) printing leads the problem, is one of the servers also a printer?, any JetDirects?. That could help you start looking also.

by mark

I would suspect a print server that is using DHCP, but anyhow you should be able to use the client information when it has a bad mask to tell what DHCP server it is using, how long the lease is, etc., and you should be able to check the DHCP Server for info on the client. This info should lead you to the solution.

I would also try and setup a reservation lease for the problem client and see if that fixes it.

by chris.rodgers

Most of the computers are running Win 98 but a few are 2k and I've seen at least one XP, I have checked into the printing set-up and that but it's not always when someone is printing. I've called the Switch Manufacturer that I use, and they were of no help. I'll check the DHCP server to see if it has a lease the next time it comes up. THere seems to be no schedule or pattern it follows that I can figure.

by kjpa

When I upgraded my network infrastructure I started having this same problem. My solution was configing my DHCP Server to be my Core Switch. Once I did that all of my problems went away.

by couldbe187

I beleive the problem is that you left the final octet blank (0) and it needs to be a ranged subnet so it has to be pretty much on and with DHCP so 130 Pcs your sub net should be 255.255.255.128. and make sure that your DHCP server is booted before the rest of the network.
if windows does not find a DHCP sever it automaticlly assigns one to itself.

by kinetechs

I'd setup a sniffer and then cause one of the PCs to get the incorrect subnet mask (by using Excel or whatever it takes). Then take a look at the traffic the sniffer collected. You should look at the DHCP traffic between the DHCP server and the PC (it'll be in clear text so you can read the IPs information the server is givving out). At least it'll let you know whether the problem is on the server or the PC.

Cheers!
~Sean

by bwheel

The only time I have seen something like this, is when the RAS server (the one included with NT/2000, as I don't remember which) was somehow misconfigured and handing out addresses to the internal clients. We were unable to fix the RAS server, and it required rebuilding it. If you have a RAS server on the same network, then maybe you could shut it down for a few to see if the problem goes away. Not much of an answer, but gives you something to look at hopefully

This discussion is closed to new replies.