Home / server / Questions / 24061
Accepted
Dan
Asked: 2009-06-12 05:13:05 +0800 CST

Windows 2003 DHCP Server - FIlled with BAD ADDRESS Entries

  • 772

Our WIndows Server 2003 DHCP scope is being filled with BAD ADDRESS leases. This happened after we started deploying Vista to the domain. It is most prevalent when a user disconnects from their wired connection and plugs back in on an alternate location.

I have ran wireshark on the DHCP server and can see the client machine refusing the DHCP address. The client requests the DHCP Address as evidenced by a DHCP REQUEST entry in the wireshark log and this is immediately followed by a DHCP DECLINED entry. It is a limited number of laptops affected by this (only Vista so far, it does affect our XP and other laptops when we run out of addresses though) The addresses it declines are valid and not currently in use.

I have turned of conflict detection on the DHCP server but it is still filling it with BAD ADDRESS entries. In these cases the user cannot get an IP address.

Another possibly related issue is that there are several users reporting IP Address Conflict messages on their laptops and workstations. These are all served from the same DHCP server. The problem is most apparent when they disconnect either wired or wireless connections or bring their machines out of hibernate mode.

My belief is that this is caused by something in Vista but it has not been resolved by deploying SP2. All machines that users report both issues (NOt able to get an address, IP address conflict) are running Vista while machines running XP get only the IP Address conflict message.

THe DHCP Lease time is 3 days. Should this be reduced? Should I reenable conflict detection? Or should I just put XP SP3 on the machines that I can?

There are 2 DHCP servers in play, they share the same scope but have mutual exclusions, it's to cover us in the event of a failure as per the 80:20 rule. The problem occurred before I added the second DHCP server.

I have scanned the network for rogue DHCP servers, I have also disabled our DHCP server (only one at that time) and requested a DHCP address, none was received.

Also, most of the machines affected have virtual PC or virtual server running.

windows windows-server-2003 windows-vista dhcp

6 Answers

  1. BAD_ADDRESS is IP address confliction, so the DHCP-server obviously gets a reply when it tries to ping those addresses. Have you tried using ping manually from the DHCP server? You could also try to look at the arp cache (arp -a in a commandline shell).

    • 4
  2. Best Answer

    Our problem stemmed from a particular set of circumstances. Vista SP1 + SP2
    "Mobile" users
    Incomplete Wireless coverage with poor handover
    Users putting their machines into hibernate and moving them off and on the network

    This caused Symantec Endpoint Protection, specifically the Network Threat Protection component to throw a fit. Disabling this component and the problem has not reoccurred. I'm 99% confident that it was symantec as we experienced the exact same issue on another site that had symantec deployed that day.

    The fix for this is to reboot the problematic machine and disable Network Threat Protection. We have a call logged with Symantec to see if this is a known issue or a potential misconfiguration. I am strongly considering recommending a move away from Symantec and sleecting trend as our A/V provider.

    • 2

  3. I don't believe that this is an inherent vista issue. No version of Vista has had this problem in our mixed environment. Could it be that some how, the NIC cards in the Vista machines were reflashed to have the same MAC address? I think that would have those symptoms. You say that wireshark shows the vista machines refusing DHCP address. Did they ask for it and then refuse it? Could a weirdo nic driver cause this problem?

    Another thought is that Vista does attempt to detect what network you are on so that it can set the firewalls appropriately. When you move machine from one location to another, is it clearly a different subnet or does it share the same IP range?

    • 0

  4. I agree with pauska, it's ip address conflicts. You MAY have;

    a.) Another overlapping DHCP server issuing addresses, which is conflicting with the scope that you're issuing now.

    b.) I agree wholeheartedly with reducing the lease time. I would set it to 8 hours or so, and delete the "BAD_ADDRESS" entries. You'll see more conflicts, but as the workstations let the addresses go, they'll renew OK. (Provided you don't have a rogue DHCP server out there! :)

    If you begin to get reports of offending workstations getting the "ip address conflict!" messages, run "ipconfig /release && ipconfig /renew" on the problematic machines.

    Oh, also.. Be forewarned, if you're using AD-integrated dynamic DNS, where your machines automatically update themselves in your DC's, once you kick down that lease time, you're going to need to compensate by scavenging those DNS entries. Maybe you could append that line up there and add, "&& ipconfig /registerdns"

    HTH..

    • 0

  5. It's a problem with the broadcast flag in DHCP in Vista.

    Check out this article for fixing your DHCP problems. http://thedaneshproject.com/posts/vista-not-working-with-dhcp/

    • 0

  6. Just Make IP to Mac Binding or in simple words just reserve those IPs in DHCP which showing as Bad address. It would work fine

    • -1