some DHCP problems

[jasboy]

I have a very similar problem to that of attrofy and I didn't want to post in his thread.

We recently installed a new win2k server with Active Directory, DNS and DHCP all enabled and configured. We have about 90 users and all seems to be working well (internet, roaming profiles, etc...) except on our sonicwall log every 7 mnutes our server (with static ip) is sending out DHCP broadcast (Destination:255.255.255.255, 67) DHCP INFORM on port 67 and DHCP ACK on port 68.

We have 2 NICs but the second is diasabled. The DHCP server has been authorized in active directory, and our DHCP ip address range is x.x.x.20 thru x.x.x.120 and our server is x.x.x.5.

DHCP realy agent is not installed since we only have one subnet (I double checked to make sure it wasn't installed).

I've also sniffed the broadcast but dont see any glaring problems in the packets. Any ideas?

Thanks

 

[bcastner]

The traffic is harmless.

It might be possible to reduce it by configuring the clients:

1. Extend their lease
2. Make certain their DNS entries point to the local DNS server and nowhere else.

In my experience the traffic is likely from printers, or other always one devices with full IP addressing.

Harmless, but check the configuration of the devices as mentioned above to see if you can reduce the traffic.

Best.

 

[jasboy]

Well, I didn't really state that it's our new server broadcasting these packets. I realize they are harmless but it is annoying having 3 pages of our sonicwall log to go thru every day. I was just trying to figure out why this was happening.

Thanks

 

[bcastner]

The server is trying to renew with your ISP.
Again, extend the lease time.

 

[jasboy]

I'm sorry bcastner, I'm not quite understanding. If my server (has dhcp enabled and has a static ip) is sending out dhcp inform and ack every 7 minutes, why would extending the lease going to help? The lease is set at 8 days.

Thanks for your help.

 

[bcastner]

I thought you stated your new server was sending the DHCP requests. I am confused how you could enable DHCP on a static IP. "If my server (has dhcp enabled and has a static ip) is sending out dhcp inform and ack every 7 minutes,"

In any case, you might check:

. That if RAS is enabled, it is given a static IP. If it is not given a static IP, it will make a DHCP request as often as every two minutes:

http://support.microsoft.com:80/support/kb/articles/Q150/2/81.asp&NoWebContent=1

. That you hae specified a Time Server, if used. Otherwise the time service will make a DHCP request as often as every 5 minutes.

 

[jasboy]

Our server (x.x.x.5) has a static ip because it serves as a dhcp server a dns server and a wins server for about 90 computers. After setting up our dhcp server (x.x.x.5) I'm flooded with 3 pages a day from our sonicwall with this:

07/06/2003 08:33:17.240 - Denied UDP packet from LAN - Source:x.x.x.5, 68, LAN - Destination:255.255.255.255, 67, LAN

this happens every 7 minutes. 24/7. I sniffed the packets and found that one is a dhcp inform and the other is a dhcp ack, both packets are from our server. I'm just trying to figure out why our server is doing this? Is it looking for a backup dhcp server? DHCP client is not enabled on this server.

Thanks for your help

Jasboy

 

[june1980]

Just wondering.... how long is the address lease on your DHCP server? It wouldn't happen to be seven minutes, would it? I ask because someone tried to put seven days as our lease time, but somehow set seven minutes. Thus, lots of broadcasting. Just a thought.

 

[jasboy]

Well, the lease is set for 8 days, and I'm noticing now that it's not always 7 minutes. Sometimes it's 8min, 4min, 1min, 7min. Vary odd.

Thanks for thought

jasboy

 

[crazynoodle]

I am almost certain what you are seeing is your DHCP server looking for rogue DHCP servers on your network. It is my understanding that this is new in Windows 2000 (not in NT4) that if another DHCP server shows up on your network and it is not authorized in Active Directory - it is suposed to kill its self off..

I am not sure if this can be stopped but I am going to look because I am curious.

Best regards,

Paul

 

[jasboy]

I was just reading about that in Mark Minasi's 2k server book. If that is the case, it's fine with me but I need to figure out how to stop our sonicwall from logging those. No, fun trying to go thru 3 or 4 pages of logs.

Thanks

jasboy

 

[bcastner]

In the Sonicwall, allow all traffic, TCP and UDP on your local LAN as a secure zone.

This is a self-inflicted wound. You are denying local broadcast traffic, and it is getting recorded.

Permit your local traffic.