PC not getting correct DHCP information


Recommended Posts

Hi,

We have a network of about 20 Windows XP PCs. We recently installed a new Switch (Netgear GS105UK) which caused major problems. The PCs IP's changed from 192.168.2.xx to 192.168.255.xx - upon removing the new switch the problem continued.

We restarted the main switches and the router, this fixed the issue for 19 out of the 20 pcs. I have also run ipconfig / flushdns. The router issues the DHCP.

Any suggestions on how to fix this?

Link to comment
Share on other sites

We use Windows Server 2003 R2 as our DNS server - I haven't restarted these no. The DHCP is handled by the router which has been restarted - and infact is issuing correct IPs to the rest of the PCs on the network.

Link to comment
Share on other sites

Some netgear switches come with a built in DHCP server which you need to disable before you deploy it. The ones i've used are managed by Netgear smart wizard initially and then via a web browser to its IP address.

DHCP addresses will be assigned by the first device that is running DHCP that responds, so if anything else, another router or server, is running DHCP and that happens to respond first you will see a different range.

However, you say you removed the switch and the problem persisted.

Check to make you reconnected everything the same as before, also check to make sure your router hasn't reset to some sort of default config.

Filing that, disconnect everything bar 1 PC and your router, if it still picks up the wrong address it can only be the router at fault.

We use Windows Server 2003 R2 as our DNS server - I haven't restarted these no. The DHCP is handled by the router which has been restarted - and infact is issuing correct IPs to the rest of the PCs on the network.

Sound like something local to these PC is dishing out DHCP responses.

Link to comment
Share on other sites

The strange thing is its working fine for the rest of the PCs - Its just 1 PC which I am having problems with. I use a GS104UK at home - I don't believe it has any sort of web interface or dhcp.

Link to comment
Share on other sites

<p>If its just one PC, are you SURE that the IP address hasn't been manually set?

It MUST be getting that address from a manual setting or from a DHCP server somewhere.

Also do an ipconfig /all, this will tell you what your current DHCP and DNS server is.

Also not trying to be picky but you told us there were 20 odd PC's affected above..

Link to comment
Share on other sites

1st Picture :This is the file showing the incorrect IP details. Our DHCP server is 192.168.2.1 not this.

2nd Picture: This is what a working one looks like (this machine has VMware too so ignore them)

post-31190-0-28358900-1324635029_thumb.j

post-31190-0-16575600-1324635230_thumb.j

Link to comment
Share on other sites

What happens if you run ipconfig /release then ipconfig /renew?

Do you know what device the 192.168.253.254 is? It could be an idea to try to navigate to this device in a browser before you do the above to see if it tells you what it is and you should be able to turn off DHCP from there too.

Link to comment
Share on other sites

Same thing, setting it to static IP works, however I would like to understand whats going on.

I have no idea what 192.168.253.254 however pinging it returns no results. As far as i'm aware 192.168.253.254 does not exist.

C:\Documents and Settings\chriss>ping 192.168.253.254

Pinging 192.168.253.254 with 32 bytes of data:

Request timed out.

Request timed out.

Request timed out.

Request timed out.

Ping statistics for 192.168.253.254:

Packets: Sent = 4, Received = 0, Lost = 4 (100% loss),

C:\Documents and Settings\chriss>

Link to comment
Share on other sites

It might have a firewall turned on though, but with the DHCP service permitted through - so wouldn't necessarily ping / reply.

You clearly have got some rogue device on your network somewhere doing this - is it possible someone has turned on Internet Connection Sharing on one of the Windows PC's?

Link to comment
Share on other sites

Hmmm, could be possible that ICS is turned on -but it shouldn't be and only 3 of us on our network have admin access. I'll have a look.

ipconfig /release then /renew didn't change it no.

Link to comment
Share on other sites

Glad you got it sorted, but yeah if you were getting an dhcp lease than for sure there was some dhcp server running on your network handing it out.

For anyone else with this issue and looking to track it down.. You could look at the arp table on the box getting the ip to see what the mac of the dhcp server is.. Ie in this case the one at 192.168.253.254

From the mac you can look up the vendor from the first 3, now with vm they use their own mac and not the physical nic they are bridged with, etc.

So for example if it was 005056

http://www.coffer.com/mac_find/?string=005056

Would of told you it was a vm, so that would of given you a clue to what was running the dhcp.

Another helpful thing is to actually sniff the traffic and look at the details of the dhcp packets for clues as well, maybe some options being sent that machine is not showing that might help, etc.

If you were running a smart or better yet fully managed switch environment -- once you have the mac you would know exactly what port its connected to on your switches.

Link to comment
Share on other sites

This topic is now closed to further replies.
  • Recently Browsing   0 members

    • No registered users viewing this page.