Welcome to ISAserver.org

Forums | Register | Login | My Profile | Inbox | RSS RSS icon | My Subscription | My Forums | Address Book | Member List | Search | FAQ | Ticket List | Log Out

Strange incoming DHCP requests.

Users viewing this topic: none

Logged in as: Guest
  Printable Version
All Forums >> [ISA Server 2004 General ] >> General >> Strange incoming DHCP requests. Page: [1]
Login
Message << Older Topic   Newer Topic >>
Strange incoming DHCP requests. - 25.Mar.2004 3:34:00 PM   
StarChase

 

Posts: 59
Joined: 5.Feb.2004
From: The Netrherlands
Status: offline 		Hi all,

I have a weird problem witch is that my isa server gets strange incoming DHCP requests all the time from some internal clients on my network.
All my clients optain a DHCP lease from my DHCP / DC server 192.168.100.5 and the lease expires after 7 day's.
Only meanwile the lease period some winXP machines (all with SP 1) request a new lease at my isa server 192.168.100.1.
And not all my winXP clients do that.
Anyone know how to stop this ?

Greatings Starchase
Post #: 1
RE: Strange incoming DHCP requests. - 26.Mar.2004 2:05:00 AM   
tshinder

 

Posts: 47659
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi Starchase,

Are the clients requesting a renewal from the ISA firewall, or is the ISA firewall just recording the DHCP broadcast messages for new requests?

Thanks!
Tom

(in reply to StarChase)
Post #: 2
RE: Strange incoming DHCP requests. - 26.Mar.2004 12:39:00 PM   
StarChase

 

Posts: 59
Joined: 5.Feb.2004
From: The Netrherlands
Status: offline 		I dont exacly know, in the isa log it seas "incoming DHCP request".
I dont think its a renew, becouse why should they, the lease expires over 7 day's.
And the weard thing is that they didnt do this before.
Are clients always broadcasting DHCP requests ?

Greatings,
Star

(in reply to StarChase)
Post #: 3
RE: Strange incoming DHCP requests. - 28.Mar.2004 8:10:00 PM   
tshinder

 

Posts: 47659
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi Star,

Run network monitor on the Internal interface of the ISA firewall and see where the requests are coming from. That information will help you determine what hosts are requesting the renewal and what DHCP they are requesting it from.

HTH<
Tom

(in reply to StarChase)
Post #: 4
RE: Strange incoming DHCP requests. - 4.Apr.2004 4:34:00 PM   
StarChase

 

Posts: 59
Joined: 5.Feb.2004
From: The Netrherlands
Status: offline 		I have looked, but it is a broadcast DHCP request.
It goes to the hole subnet 255.255.255.255 on port 67. The main problem is that my isa server forwards these requests to my DHCP scope on my DC becouse it is set to do so for remote VPN users. Becouse of this my whole scope range runs full. I just restarted the requesting client but it doesnt resolve this problem.

[ April 04, 2004, 04:36 PM: Message edited by: StarChase ]

(in reply to StarChase)
Post #: 5
RE: Strange incoming DHCP requests. - 4.Apr.2004 8:20:00 PM   
tshinder

 

Posts: 47659
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi Star,

Could it be the VPN service on the ISA box? Have you configured VPN to use DHCP?

The DHCP requests include the requesting host's MAC address, so you can identify who's sending it from that value.

HTH,
Tom

(in reply to StarChase)
Post #: 6
RE: Strange incoming DHCP requests. - 6.Apr.2004 2:36:00 PM   
StarChase

 

Posts: 59
Joined: 5.Feb.2004
From: The Netrherlands
Status: offline 		Hi Tom,

The ISA box (192.168.100.1) is set to forward DHCP requests form VPN clients to my DC (192.168.100.5).

My internal clients begin from 192.168.100.10 til 192.168.100.20.
In the monitoring of the ISA it seas that 192.168.100.12 and 192.168.100.14 are broadcasting a DHCP request to the whole subnet 255.255.255.255 on port 67. These are internal lan clients and not VPN clients.

The ip lease expires after 7 or 8 day's (default setting in DHCP scope of the DC). I think its a sort of software problem on these 2 clients becouse my other XP clients do not broadcast a DHCP request. But i cant figure out why and how. Why would they ask a new ip lease if thear current ip lease isent expired yet?

[ April 06, 2004, 02:37 PM: Message edited by: StarChase ]

(in reply to StarChase)
Post #: 7
RE: Strange incoming DHCP requests. - 10.Apr.2004 7:05:00 PM   
tshinder

 

Posts: 47659
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi StarChase,

The DHCP clients renew their addresses at 50% of the TTL. So perhaps that is the issue? You can see this in a NetMon trace.

HTH,
Tom

(in reply to StarChase)
Post #: 8
RE: Strange incoming DHCP requests. - 13.Apr.2004 2:32:00 PM   
StarChase

 

Posts: 59
Joined: 5.Feb.2004
From: The Netrherlands
Status: offline 		Aha, i didnt think of that, i will look at it.
Thanxz Tom.

(in reply to StarChase)
Post #: 9
RE: Strange incoming DHCP requests. - 13.Apr.2004 4:53:00 PM   
tshinder

 

Posts: 47659
Joined: 10.Jan.2001
From: Texas
Status: offline 		Hi StarChase,

Let us know what you find out.

Thanks!
Tom

(in reply to StarChase)
Post #: 10

Page:   [1] << Older Topic    Newer Topic >>
All Forums >> [ISA Server 2004 General ] >> General >> Strange incoming DHCP requests. Page: [1]
Jump to:

New Messages No New Messages
Hot Topic w/ New Messages Hot Topic w/o New Messages
Locked w/ New Messages Locked w/o New Messages
 Post New Thread
 Reply to Message
 Post New Poll
 Submit Vote
 Delete My Own Post
 Delete My Own Thread
 Rate Posts