none
Where are my free IPs? the case of the vanishing addresses RRS feed

  • Question

  • I have a DHCP Server, running a fully-patched WIn2012R2, since 2015, 1 Server, several Scopes, everything is all right

    but...

    Recently we saw a ScopeiD with zero address available, with no reason

    The Scope: 10.10.60.0, configured as 10.10.60.1 to 10.10.60.254

    Lease range: DO NOT allow 10.10.60.1, and also 10.10.60.2-10.10.60.127 and also 10.10.60.128-180

    So

    the available range to give IPs is 10.10.60.181 until 10.10.60.254, so, 74 available addresses to be leased to clients

    But, the actual leases are:

    PS C:\Windows\system32> Get-DhcpServerv4Lease 10.10.60.0

    IPAddress       ScopeId         ClientId             HostName             AddressState         LeaseExpiryTime
    ---------       -------         --------             --------             ------------         ---------------
    10.10.60.216   10.10.60.0     00-15-5e-7d-3b-e2    ora-rac1             Active               16/02/2019 14:00:09
    10.10.60.217   10.10.60.0     00-15-5e-7d-3b-e3    ora-rac2             Active               16/02/2019 11:24:14
    10.10.60.220   10.10.60.0     78-2b-cb-c4-a6-33    PCSS-DSK0500        ActiveReservation
    10.10.60.225   10.10.60.0     00-26-73-63-ed-5b    PCSS-MTF0002        ActiveReservation
    10.10.60.226   10.10.60.0     00-26-73-62-49-05    PCSS-MTF0006        ActiveReservation
    10.10.60.227   10.10.60.0     00-26-73-62-ed-8f    PCSS-MTF0008        ActiveReservation
    10.10.60.228   10.10.60.0     00-26-73-63-ed-c9    PCSS-MTF0001        ActiveReservation
    10.10.60.229   10.10.60.0     00-26-73-62-27-90    PCSS-MTF0010        ActiveReservation
    10.10.60.230   10.10.60.0     00-26-73-62-27-7b    PCSS-MTF0013        ActiveReservation
    10.10.60.231   10.10.60.0     00-26-73-71-1c-86    PCSS-MTF0011        ActiveReservation
    10.10.60.232   10.10.60.0     00-26-73-63-ed-b4    PCSS-MTF0004        ActiveReservation
    10.10.60.233   10.10.60.0     00-26-73-63-11-e7    PCSS-MTF0003        ActiveReservation
    10.10.60.234   10.10.60.0     00-26-73-62-f9-d6    PCSS-MTF0012        ActiveReservation
    10.10.60.235   10.10.60.0     00-26-73-62-28-a7    PCSS-MTF0009        ActiveReservation
    10.10.60.236   10.10.60.0     00-26-73-62-27-24    PCSS-MTF0007        ActiveReservation
    10.10.60.237   10.10.60.0     00-26-73-63-13-a7    PCSS-MTF0005        ActiveReservation

    So, i have only 16 addresses in use.. so why is DHCP showing a warning and there is a  local event ID showing no address to lease?

    Where are my 10.10.60.181, 182, 183 and so one? There are no devices within this range inside my network...

    Look like Ips from 180 through 215 are missing, but they never existed... so... all CMDs, powershell, NETSH are not able to show me why a scope with so fez DHCP clients are using so many addresses

    I did stop DHCP Server, and compacted and jetpacked the dhcpp.mdb and started DHCP Server again

    I´m wondering if there is a mismatch between dhcp database and registry information

    • Edited by KayZerSoze Friday, February 15, 2019 7:44 PM typo
    Friday, February 15, 2019 7:19 PM

Answers

  • After doing a reconcile operation, a lot of things have appeared and... probably there is a broadcast storm-like operating in the VLAN:

    So i deleted the BOOTP entries and everything went back to normal

    Client IP Address Type Unique ID
    10.121.60.161 DHCP/BOOTP 31302e3132312e36302e31363100
    10.121.60.163 DHCP/BOOTP 31302e3132312e36302e31363300
    10.121.60.181 DHCP/BOOTP 31302e3132312e36302e31383100
    10.121.60.182 DHCP/BOOTP 31302e3132312e36302e31383200
    10.121.60.183 DHCP/BOOTP 31302e3132312e36302e31383300
    10.121.60.184 DHCP/BOOTP 31302e3132312e36302e31383400
    10.121.60.185 DHCP/BOOTP 31302e3132312e36302e31383500
    10.121.60.186 DHCP/BOOTP 31302e3132312e36302e31383600
    10.121.60.187 DHCP/BOOTP 31302e3132312e36302e31383700
    10.121.60.188 DHCP/BOOTP 31302e3132312e36302e31383800
    10.121.60.189 DHCP/BOOTP 31302e3132312e36302e31383900
    10.121.60.190 DHCP/BOOTP 31302e3132312e36302e31393000
    10.121.60.191 DHCP/BOOTP 31302e3132312e36302e31393100
    10.121.60.192 DHCP/BOOTP 31302e3132312e36302e31393200
    10.121.60.193 DHCP/BOOTP 31302e3132312e36302e31393300
    10.121.60.194 DHCP/BOOTP 31302e3132312e36302e31393400
    10.121.60.195 DHCP/BOOTP 31302e3132312e36302e31393500
    10.121.60.196 DHCP/BOOTP 31302e3132312e36302e31393600
    10.121.60.197 DHCP/BOOTP 31302e3132312e36302e31393700
    10.121.60.198 DHCP/BOOTP 31302e3132312e36302e31393800
    10.121.60.199 DHCP/BOOTP 31302e3132312e36302e31393900
    10.121.60.200 DHCP/BOOTP 31302e3132312e36302e32303000
    10.121.60.201 DHCP/BOOTP 31302e3132312e36302e32303100
    10.121.60.202 DHCP/BOOTP 31302e3132312e36302e32303200
    10.121.60.203 DHCP/BOOTP 31302e3132312e36302e32303300
    10.121.60.204 DHCP/BOOTP 31302e3132312e36302e32303400
    10.121.60.205 DHCP/BOOTP 31302e3132312e36302e32303500
    10.121.60.206 DHCP/BOOTP 31302e3132312e36302e32303600
    10.121.60.207 DHCP/BOOTP 31302e3132312e36302e32303700
    10.121.60.208 DHCP/BOOTP 31302e3132312e36302e32303800
    10.121.60.209 DHCP/BOOTP 31302e3132312e36302e32303900
    10.121.60.210 DHCP/BOOTP 31302e3132312e36302e32313000
    10.121.60.211 DHCP/BOOTP 31302e3132312e36302e32313100
    10.121.60.212 DHCP/BOOTP 31302e3132312e36302e32313200
    10.121.60.213 DHCP/BOOTP 31302e3132312e36302e32313300
    10.121.60.214 DHCP/BOOTP 31302e3132312e36302e32313400
    10.121.60.215 DHCP/BOOTP 31302e3132312e36302e32313500
    10.121.60.218 DHCP/BOOTP 31302e3132312e36302e32313800
    10.121.60.219 DHCP/BOOTP 31302e3132312e36302e32313900
    10.121.60.221 DHCP/BOOTP 31302e3132312e36302e32323100
    10.121.60.222 DHCP/BOOTP 31302e3132312e36302e32323200
    10.121.60.223 DHCP/BOOTP 31302e3132312e36302e32323300
    10.121.60.224 DHCP/BOOTP 31302e3132312e36302e32323400
    10.121.60.238 DHCP/BOOTP 31302e3132312e36302e32333800
    10.121.60.239 DHCP/BOOTP 31302e3132312e36302e32333900
    10.121.60.240 DHCP/BOOTP 31302e3132312e36302e32343000
    10.121.60.241 DHCP/BOOTP 31302e3132312e36302e32343100
    10.121.60.242 DHCP/BOOTP 31302e3132312e36302e32343200
    10.121.60.243 DHCP/BOOTP 31302e3132312e36302e32343300
    10.121.60.244 DHCP/BOOTP 31302e3132312e36302e32343400
    10.121.60.245 DHCP/BOOTP 31302e3132312e36302e32343500
    10.121.60.246 DHCP/BOOTP 31302e3132312e36302e32343600
    10.121.60.247 DHCP/BOOTP 31302e3132312e36302e32343700
    10.121.60.248 DHCP/BOOTP 31302e3132312e36302e32343800
    10.121.60.249 DHCP/BOOTP 31302e3132312e36302e32343900
    10.121.60.250 DHCP/BOOTP 31302e3132312e36302e32353000
    10.121.60.251 DHCP/BOOTP 31302e3132312e36302e32353100
    10.121.60.252 DHCP/BOOTP 31302e3132312e36302e32353200
    10.121.60.253 DHCP/BOOTP 31302e3132312e36302e32353300
    10.121.60.254 DHCP/BOOTP 31302e3132312e36302e32353400


    • Marked as answer by KayZerSoze Friday, February 15, 2019 8:12 PM
    • Edited by KayZerSoze Friday, February 15, 2019 8:16 PM typo
    Friday, February 15, 2019 7:47 PM

All replies

  • After doing a reconcile operation, a lot of things have appeared and... probably there is a broadcast storm-like operating in the VLAN:

    So i deleted the BOOTP entries and everything went back to normal

    Client IP Address Type Unique ID
    10.121.60.161 DHCP/BOOTP 31302e3132312e36302e31363100
    10.121.60.163 DHCP/BOOTP 31302e3132312e36302e31363300
    10.121.60.181 DHCP/BOOTP 31302e3132312e36302e31383100
    10.121.60.182 DHCP/BOOTP 31302e3132312e36302e31383200
    10.121.60.183 DHCP/BOOTP 31302e3132312e36302e31383300
    10.121.60.184 DHCP/BOOTP 31302e3132312e36302e31383400
    10.121.60.185 DHCP/BOOTP 31302e3132312e36302e31383500
    10.121.60.186 DHCP/BOOTP 31302e3132312e36302e31383600
    10.121.60.187 DHCP/BOOTP 31302e3132312e36302e31383700
    10.121.60.188 DHCP/BOOTP 31302e3132312e36302e31383800
    10.121.60.189 DHCP/BOOTP 31302e3132312e36302e31383900
    10.121.60.190 DHCP/BOOTP 31302e3132312e36302e31393000
    10.121.60.191 DHCP/BOOTP 31302e3132312e36302e31393100
    10.121.60.192 DHCP/BOOTP 31302e3132312e36302e31393200
    10.121.60.193 DHCP/BOOTP 31302e3132312e36302e31393300
    10.121.60.194 DHCP/BOOTP 31302e3132312e36302e31393400
    10.121.60.195 DHCP/BOOTP 31302e3132312e36302e31393500
    10.121.60.196 DHCP/BOOTP 31302e3132312e36302e31393600
    10.121.60.197 DHCP/BOOTP 31302e3132312e36302e31393700
    10.121.60.198 DHCP/BOOTP 31302e3132312e36302e31393800
    10.121.60.199 DHCP/BOOTP 31302e3132312e36302e31393900
    10.121.60.200 DHCP/BOOTP 31302e3132312e36302e32303000
    10.121.60.201 DHCP/BOOTP 31302e3132312e36302e32303100
    10.121.60.202 DHCP/BOOTP 31302e3132312e36302e32303200
    10.121.60.203 DHCP/BOOTP 31302e3132312e36302e32303300
    10.121.60.204 DHCP/BOOTP 31302e3132312e36302e32303400
    10.121.60.205 DHCP/BOOTP 31302e3132312e36302e32303500
    10.121.60.206 DHCP/BOOTP 31302e3132312e36302e32303600
    10.121.60.207 DHCP/BOOTP 31302e3132312e36302e32303700
    10.121.60.208 DHCP/BOOTP 31302e3132312e36302e32303800
    10.121.60.209 DHCP/BOOTP 31302e3132312e36302e32303900
    10.121.60.210 DHCP/BOOTP 31302e3132312e36302e32313000
    10.121.60.211 DHCP/BOOTP 31302e3132312e36302e32313100
    10.121.60.212 DHCP/BOOTP 31302e3132312e36302e32313200
    10.121.60.213 DHCP/BOOTP 31302e3132312e36302e32313300
    10.121.60.214 DHCP/BOOTP 31302e3132312e36302e32313400
    10.121.60.215 DHCP/BOOTP 31302e3132312e36302e32313500
    10.121.60.218 DHCP/BOOTP 31302e3132312e36302e32313800
    10.121.60.219 DHCP/BOOTP 31302e3132312e36302e32313900
    10.121.60.221 DHCP/BOOTP 31302e3132312e36302e32323100
    10.121.60.222 DHCP/BOOTP 31302e3132312e36302e32323200
    10.121.60.223 DHCP/BOOTP 31302e3132312e36302e32323300
    10.121.60.224 DHCP/BOOTP 31302e3132312e36302e32323400
    10.121.60.238 DHCP/BOOTP 31302e3132312e36302e32333800
    10.121.60.239 DHCP/BOOTP 31302e3132312e36302e32333900
    10.121.60.240 DHCP/BOOTP 31302e3132312e36302e32343000
    10.121.60.241 DHCP/BOOTP 31302e3132312e36302e32343100
    10.121.60.242 DHCP/BOOTP 31302e3132312e36302e32343200
    10.121.60.243 DHCP/BOOTP 31302e3132312e36302e32343300
    10.121.60.244 DHCP/BOOTP 31302e3132312e36302e32343400
    10.121.60.245 DHCP/BOOTP 31302e3132312e36302e32343500
    10.121.60.246 DHCP/BOOTP 31302e3132312e36302e32343600
    10.121.60.247 DHCP/BOOTP 31302e3132312e36302e32343700
    10.121.60.248 DHCP/BOOTP 31302e3132312e36302e32343800
    10.121.60.249 DHCP/BOOTP 31302e3132312e36302e32343900
    10.121.60.250 DHCP/BOOTP 31302e3132312e36302e32353000
    10.121.60.251 DHCP/BOOTP 31302e3132312e36302e32353100
    10.121.60.252 DHCP/BOOTP 31302e3132312e36302e32353200
    10.121.60.253 DHCP/BOOTP 31302e3132312e36302e32353300
    10.121.60.254 DHCP/BOOTP 31302e3132312e36302e32353400


    • Marked as answer by KayZerSoze Friday, February 15, 2019 8:12 PM
    • Edited by KayZerSoze Friday, February 15, 2019 8:16 PM typo
    Friday, February 15, 2019 7:47 PM
  • I am having a similar problem with the DHCP leases on a 2012 R2 Server. Something on the network is taking all of the available IP addresses from the DHCP pool which means that the computers/devices that need to be on the network cannot get an address. The device name is 09592311192f11bad3a98b8b0000b022.domainname.local and the MAC address that is in the table is d003be020001000124004163e076d003be02. If I run arp -a I get a MAC of e0-76-d0-03-be-02 which points to AMPAK Technologies, Inc. Yesterday I also located a device with the name espressif.domainname.local which I didn't recognize with a MAC of 30-ae-a4-5d-5d-20.

    I am going to try going to every device and disconnect to see if I can find the offending device. Any other insight would be appreciated.


    Update: 2/23/19 - It appears that the device that I found, esprssif was using the Wireless to access the network and cause the problem. Still not sure where the device is located.
    • Edited by Tanis53 Saturday, February 23, 2019 4:39 PM
    Thursday, February 21, 2019 7:40 PM