Duplicate IPs/BAD_ADDRESS all over the place!

[dallas4u]

Need help please! For about a week now many of our machines have been getting duplicate IP errors, which in turn have been filling DHCP leases with the 'BAD_ADDRESS' names. It seems 5-6 of the 'BAD_ADDRESS' names correspond to one machine (or one MAC, really). We have a wireless network as well, and if we switch the laptops in question to wireless they are able to pull an IP with correct scope info and everything is fine. As soon as you take them off of wireless, plug in the ethernet cable, and they machine tries to pull an IP it automatically gives a duplicate IP error, DHCP fills up with 'BAD_ADDRESS' conflicts, and no matter what we try to do we cannot get the wires connection to work with DHCP.

This seems to only be on 4-5 machines right now. 4 of them are laptops, which are either turned off at night or taken home and returned in the morning. One is a new desktop that I just installed XP on, put it on the domain, and wamm-o... IP conflict. No matter how many times I go in to DHCP, remove the IP address for the desktop, reserve the address for the MAC I see it conflicting with in event viewer, whatever... as soon as I plug the cable back in the IP address it pulls conflicts with another IP. It's like it isn't pulling new IPs, just trying to take IPs already being used.

Now, let me try and explain the network setup in DHCP. One subnet (172.18.32.0) split between two DC's, and put in two Superscopes. One has about 30 IPs to hand out (172.18.32.101 - .130) and the other has about 123 IPs to hand out (172.18.32.131 - .254). Both DC's were playing fine with DHCP between each other until about a week ago. I can't think of anything that has changed within the config of DHCP or anywhere else. I don't understand why it's happening or how to stop it.

Can anyone help??

 

[jay57]

This is probably going to take a little more detective work.

First, when you plugged the new XP machine in, you claim that it immediately generated a conflict. What IP did it get? And which server provided it?

Second, on the XP machine, have you tried releasing the IP address and then requesting it again? What do you get and which server gave it you? Is it consistent?

Third, have you used "arp" on your dhcp servers? That can be your best friend in determining conflicts.

Fourth, Is your wireless router still on the network? Whose is it? Is it caching IP addresses for it's wireless connections? Is it running a DHCP server (a lot of them can)?

This is just a start, and I'm no windows expert.I prefer Solaris for this kind of work, but there are several possibilities here for errors.
--
Jay

 

[dallas4u]

Thanks for the reply. I'll answer your questions in order:

1. I'm finding it isn't just new machines. It seems to be when a machine is turned off during it's IP lease expiration time as well. So, any machine that needs to pull a new address when the lease time is up. Also, no specific IP. If you go in to event viewer it will show the same MAC for every conflicting IP address. Not sure how to find the machine with that MAC, but it does show the same MAC that seems to be the culprit.

2. Yes, I've tried releasing and renewing multiple upon multiple times, same issue. In fact, the IP is usually assigned by DC1 or DC1 just depending on if there are any available IPs to assign from DC1 (it is completely full). DC1 and DC2 are on the same subnets but different superscopes. One assigns IPs from .101 - .130 and the other from .131 - .254.

3. The only arp I've done on the DHCP server is arp /a to look at requests. When a machine is currently getting a conflict I can arp and see the IP in question, and it will show me that MAC address that comes up on the machines event viewer as the conflicting machine in questions, but from that point I can really do anything. I've looked at all machines pulling IP leases and their MACs, nothing matches this one. The 'BAD_ADDRESS' machines, some will be pingable, and I've tried setting these as excluded in the address pools, just to get them out of the way. Nothing seems to work.

4. The Cisco wireless controller is on the network. It has a static IP. The 4 Cisco wireless APs are connected to the controller and have static IPs as well. Neither the APs or controller as set to hand out address.

Thanks for the help!!!