Wednesday, March 07, 2012 8:03 PM
Hello, I am studying for the 70-291 cert exam and started playing around with dhcploc. I have attached a screenshot of a portion of what it recorded. I am aware that .153 is a DHCP server, it is not rogue. I just didn't out it in as a server because I was testing things at the time. Anyway, I noticed a lot of ACK (IP)0.0.0.0 in our logs and was curious what is going on that causes them to appear. Also, if this is a simple request/offer/acknowledgement procedure, why would have have the same IP address being acknowledged repeatedly. 1.149 is the best example of this. Is there an issue I should look for when I see an IP hitting the server repeatedly? I am aware of who each of these users are, and am confident that they don't have any rogue programs running. Our servers are not setup well and desperately need cleaned up. I'm hoping that I can learn some through this and maybe clean up the process.
Later in this same log, we started getting some NACK for the 0.0.0.0 also. If anyone could give me some quick pointers, I'd appreciate it, as most of the resources I have found have not yet addressed these questions. They have told me what I should see/should expect, but they often don't cover anything out of the normal... Thank you in advance.
Thursday, March 08, 2012 4:26 AMModerator
Please post in Training and Certification forum
Training and Certification
- Marked As Answer by Cheers ZHANGMicrosoft Contingent Staff, Moderator Wednesday, March 14, 2012 1:57 AM
Thursday, March 08, 2012 1:19 PMAlright, I've posted in that forum now, but I'd like to ask why I'm being bounced to that one from this one. This is a valid question regarding the management of the servers at the business I work at. Would I have still been told to post there if I hadn't mentioned I came across this while studying? It seems to me that everyone who posts a question on this forum is trying to learn something. Me trying to get my cert was only the introduction to how I came across this issue on our servers...