Topic: DHCP mystery

[Nick Evans]

I'm running SME5.6u4 on a small office network with WinXP(home) workstations.   The range of IP addresses allocated by the DHCP server is the SME default of x.x.x.65 through to x.x.x.250.  

Occasionally, on connecting to the server, a workstation appears to be allocated an IP address from a different subnet altogether.  Instead of 192.168.x.65 it shows on the workstation as 192.168.1.15.  Needless to say, the workstation can't see the server.  However, as far as the server is concerned, it thinks it has allocated an address in the correct range.  

I suspect that the answer lies at the workstation end  but I can't see where.  I have tried deleting and recreating the network connection  but this makes no difference.

Has anybody else experienced this and, if so, any thoughts on how to cure it?  

TIA

Nick

[guestHH]

maybe you can 'fix' the give IP lease by adding the xp stations to the hostnames panel in the server manager

[Bill Pflaumer]

To find the root of the problem, Install ethereal http://www.ethereal.com on the workstation, start the packet capture and at the workstation do a 'ipconfig /release' followed by a 'ipconfig /renew'. You may have another DHCP Server or rouge DHCP server in your network. Ethereal will show you the DHCP Requests,discovery and ACK from the DHCP Server

[Walter Padgett]

Good Morning,

Just read this thread after posting another new topic. Concerning the hostname scenario that RequestedDeletion presented, is there a way to restrict DHCP leases to the list of hostnames in SME?

Later

Wally

[Maggard]

Most IP stacks utilizing DHCP are set to "time out" after some interval waiting for a DHCP response.  They then generate a random non-routable address, test to see if it is already in use, and if not proceed to use that until otherwise updated. Such addresses are:

10.0.0.0 - 10.255.255.255  (10/8 prefix)
172.16.0.0 - 172.31.255.255  (172.16/12 prefix)
192.168.0.0 - 192.168.255.255 (192.168/16 prefix)

It is possible that your workstations are for whatever reason not "seeing" your (SME) DHCP server on an irregular basis. The cause could be anything from a very slow server to network congestion to bad cabling. They therefore pick a random address and go ahead with their bootup, showing up later with their self-assigned addresses.

Another possibility is you've another DHCP server on the network. Perhaps someone has installed one of the popular consumer "routers" as a switch (they're the same price now) and it's DHCP function is still active. Or there's a WiFi device doing the same. These devices quite often get "donated" without going through channels.

Or someone may have downloaded an application that among it's many services offers DHCP along with proxy or tunneling or whatever. Check also for another full server - someone putting in a test install of Windows-MegaII and accidentally starting it's DHCP server.

Be aware you might see only intermittent evidence of another DHCP router depending on network configuration and load (and it being active at any time). It might be visible only to part of a network, or only respond faster to clients searches for a DHCP server when the SME's DHCP server is delayed.

My advice would be to track this down. You could have someone "leaking" network access inside your firewall. Also being able to easily map addresses to devices can be invaluable when tracking down network problems. Indeed I'm seeing some shops only giving DHCPed devices minimal access and reserving full connectivity to static IPs (FWIW).

[Nick Evans]

Thanks for all your comments - the mystery is now solved.  We did indeed have a router being used as a hub.  Thanks to Maggard for suggesting this.  

Nick