DHCP Server out of addresses

[wfbtr]

I have a 2K server running DHCP. The only scope has 21 addresses. There's only 6 pc's on the network. I tried to plug my laptop into a hub and it wouldn't get an ip, so I checked the statistics which state that all 21 are being used. But under the clients only the 6 show up. I added 10 addresses to the scope which allowed me to get an ip, then I released it, which still leaves 10 open. I also reduced the lease time to 10 minutes and waited over an hour. Still shows 21 being used.
I checked microsoft and they talk about different subnets, but I only have one subnet.
Any thoughts? I'm stumped.

 

[ricpinto]

Can you post the scope range, subnet, options? Ipconfig/all from server and PC.

 

[Shadow97]

just a thought...have you tried resetting your hub?

 

[wfbtr]

it's not the hub, as I also tried going straight into the switch. I'm thinking it may be RRAS. Could be sessions that are not closing?

 

[Shadow97]

WINS playing up? try tombstoning all the dud records...

 

[wfbtr]

thanks, Shadow-
there were only two records that were tombstoned. But I looked at the WINS server statistics and it has
Total queries: 17,846
records found: 1,224
records not found: 16,622

There's one '98 machine, the rest XP. Now that I increased the scope by 10, 4 more ip's are out, but the DHCP address leases only show the 5 machines. And I checked RRAS, and we're not using it. We use PIX as the VPN server.
now I'm really stumped.


my scope it 192.168.102.50-80 (it was up to 70 but I increased it to 80 cuz I was out of ip's)
scope options are:
003 Router
006 DNS servers
015 DNS Domain Name
044 WINS servers
046 WINS type

 

[Shadow97]

sounds like a tricky problem... do you have any other subnets with machines/routers configured to use dhcp relay? could be that machines on other networks are stealing your IP's

 

[wfbtr]

yes, I have one other subnet that is used for VPN. I'm not sure how to monitor that, as I'm not using RRAS. I have a PIX firewall that handles the VPN. But it doesn't serve DHCP addresses.

 

[wfbtr]

i locked down all the nodes with reserved ip's. i also narrowed it down to one node that kept requesting all the new ip's. once i locked it down everything seems to be ok. could that be a faulty nic, or something else?

 

[wfbtr]

I'm still having a problem with all my addresses in my one scope being used up. I put all 6 of my machines on the LAN on reserved addresses. I have one LAN printer with a static IP. All are connected to a switch, except the printer and one pc share a hub. I have a static VPN with another site, and both sites use PIX firewall. The weird thing is nothing shows up under "address leases". I reduced the scope to 10 addresses and that cleared it, but not an hour went by and all the addresses are out again.
any hints would be appreciated.
thanks.

 

[Shad007]

Hi wfbtr...its Shadow97 here (changed my name)

just curious..how are you allocating ip addresses to your vpn users?

 

[wfbtr]

Hi Shadow-
my PIX firewall allocates from a pool I created for VPN users.

I closed out my scope for a whole day. I deleted all connections and recreated the scope. It's been up now for about 24 hours. Right now all the ip's are open except one, which is a lot better than before, but I still can't tell where that one is coming from, as it isn't listed in the leases folder- just the reserved ip's are listed.

 

[Shad007]

not sure if this is exactly whats happening but do you think that users on VPN are consuming your IP's and the pix isn't releasing them properly when they disconnect? i've seen this happen before...admittedly it wasn't a pix but a RRAS server...you could check that the phantom vpn connections were there by going to a cmd prompt and typing netstat -n |find "1720" ..this would list all vpn sockets..turned out there were more sockets in use than there were VPN connections shown as active under RRAS admin...

you may be able to target whether the pix is the cause of the problem by perhaps rebooting the pix when it happens again...a bit extreme but it sounds like you've had the problem for a while. If it is the pix you may want to look at housing the VPN server elsewhere if you can't get a fix for it.

 

[wfbtr]

thanks shadow. i did test the VPN on two clients. I could see when an address was leased, then released when the VPN was disconnected. Right now there's just one address leased out, so I'll check my PIX to see if I can track it down.