none
DHCP BAD address RRS feed

  • Question

  • We have recently migrated server from windows server 2008 to 2012 and it has two roles; DHCP and DNS.

    All of a sudden we started mailers from Network team stating huge ARP requests are created from DHCP servers.

    When checked in DHCP console, we find many ip getting bad address with strange 8 digit unique id rather than the traditional MAC id.

    Client IP Address Name Lease Expiration Type Unique ID Description Network Access Protection Probation Expiration Filter Profile Policy

    10.255.124.34 BAD_ADDRESS 5/23/2018 5:09:58 PM DHCP 227cff0a This address is already in use Full Access N/A None
    10.255.124.36 BAD_ADDRESS 5/24/2018 3:40:17 AM DHCP 247cff0a This address is already in use Full Access N/A None
    10.255.124.56 BAD_ADDRESS 5/23/2018 4:43:02 PM DHCP 387cff0a This address is already in use Full Access N/A None

    On further analysis we could able to figure out that these are the reverse hex value of the IP addreess.

    Example ;

    10 - oa

    255 - ff

    124 - 7c

    56 - 38

    We couldn't figure out why we are getting these Unique ID and bad address, Since we are not able to track from firewall / DHCP and systems logs.

    Not sure what device went rogue in our environment either the the NS device or DHCP or Windows clients.

    Any help would be highly appreciated, Thanks.




    Satheesh

    Thursday, May 17, 2018 7:27 AM

All replies