some dhcp somewhere issuing incorrect ip info

nvisibl · 03-10-2009, 04:56 AM

is there a way where i can tell from an XP client which DHCP server the client got its IP from?

some of the clients are picking up incoorect dns info from somewhere and i can't yet locate whats causing it

thanks for your help

**johnwill** · 03-10-2009, 09:06 AM

Not really, you could try using something like WireShark to monitor the connection and see where the DHCP handshake comes from.

**djaburg** · 03-10-2009, 11:12 AM

Is this a wireless network?

Ghiyas · 03-10-2009, 11:42 AM

Even u can use the command ipconfig /all to view the dhcp server ip address

**johnwill** · 03-11-2009, 04:18 PM

Quote:

Originally Posted by Ghiyas

Even u can use the command ipconfig /all to view the dhcp server ip address

Which doesn't tell you a thing about where the DHCP server is.

nvisibl · 03-12-2009, 03:43 AM

ipconfig /all mentions the IP address of the DHCP server... would this then definately be the DHCP server from where the rest of the IP information came from?

I take it that it is.

The problem I have is that the clients are picking up an incorrect address for the primary DNS server. Should be 192.168.1.4 but instead its showing up as 192.168.1.1

My DHCP server runs on the same 192.168.1.4 server, and this is the DHCP server address that shows up on the clients when I do an ipconfig

On double checking the DHCP scope on the server the DNS server address is the correct one 192.168.1.4 so I don't understand how the clients are sporadicaly picking up 192.168.1.1 especially if it comes from the correct DHCP server on 192.168.1.4

The clients are configured to obtain their IP address and DNS from DHCP, so there is no static DNS entries on the clients within the IP properties page.

nvisibl · 03-12-2009, 05:39 AM

hmmmmmm... something strange seems to be going on

just done a brand new XP build as per our standard build, it was connecting to the web okay etc... as it should and so had retrieved the correct IP info from the DHCP server which includes the primary DNS of 192.168.1.4

the dhcp lease time = 1 week

without having switched off the pc or messed about with any settings IP or otherwise i noticed that i couldn't connect to the web all of a sudden. and so on checking the ip details as a result of this i noticed the cause being that the primary DNS setting had changed to this incorrect address of 192.168.1.1

strange or what?

clyde123 · 03-13-2009, 06:26 AM

If this 192.168.1.4 should never change, just configure that into the Internet Connection as a fixed number for the DNS server.

nvisibl · 03-13-2009, 06:35 AM

thank you and sure its the most viable workaround but doesn't answer the root issue and plus makes things less dynamic

**djaburg** · 03-13-2009, 08:35 AM

Well my question still remains unanswered...is this a wireless network? If it's not, then you MUST have another device on the network acting as a DHCP server. Get a utility like lookatlan and have it scan.

nvisibl · 03-13-2009, 10:20 AM

excuse for not before responding djaburg.... its a wired network.. i have lookatlan but not sure it can help other than by giving a general list of network nodes

the thing that puzzles me is that the DNS ip seems to change automatically without my rebooting or messing with the IP config. it changes even though the dhcp lease is set to 1 week

**bilbus** · 03-14-2009, 03:25 PM

... ipconfig /all will list the dhcp server, and its IP.

You can use dhcpfind, its a free downloadable tool. It will list all the dhcp servers on your subnet, if you have relay agents, it will also show dhcp servers on a remote subnet.

I can tell you what the problem is, somone hooked up their home router to your network, and it's dhcping addresses. I bet they wanted to use wifi.

nvisibl · 03-16-2009, 02:52 AM

dhcpfind sounds handy thabnks will go look for it now

if a client has a dhcp assigned IP config from a dhcp server with a lease time of 1 week, is it possible that client can obtain ip info from another dhcp server in the interim, even though the original lease remains current? this without the client being rebooted or reconfigured in any way.

**bilbus** · 03-16-2009, 02:59 AM

Yup, wont be a problem

you may have to ipconfig /release, ipconfig /renew

nvisibl · 03-16-2009, 04:03 AM

thanks but its not the IP onfo that needs changing, i'm trying to find out why the clients after picking up correct DHCP info are after a while picking up incorrect DNS info. this without the client being rebooted or my doing an ipconfig /release. i find it most puzzling, and wonder if its correct behaviour that a dhcp client should let go of its lease and pick up another even when the lease hasn't expired, and the machine hasn't been rebooted or initial IP released

**bilbus** · 03-16-2009, 04:08 AM

It will ask for a new ip every time it boots up.

Usualy it will recieve the same ip, and won't change. If it gets a new IP, it should change it.

What dns information is wrong? server or workstation A recods?

nvisibl · 03-16-2009, 05:10 AM

the dhcp server info is correct on the server and clients pick up the correct info from the correct DHCP, but many clients thereafter automatically configure with an incorrect DNS server IP........this occurs on a random basis

Quote:

Originally Posted by nvisibl

hmmmmmm... something strange seems to be going on

just done a brand new XP build as per our standard build, it was connecting to the web okay etc... as it should and so had retrieved the correct IP info from the DHCP server which includes the correct primary DNS of 192.168.1.4

the dhcp lease time = 1 week

without having switched off the pc or messed about with any settings IP or otherwise i noticed that i couldn't connect to the web all of a sudden. and so on checking the ip details as a result of this i noticed the cause being that the primary DNS setting had changed to this incorrect address of 192.168.1.1

strange or what?

nvisibl · 03-16-2009, 05:55 AM

Okay... running dhcpfinder on a client and it reports that a DHCP server with address 8.255.0.0 is sending packets to it

we operate a 192 network... and i am also unable to ping this 8.255.0.0. server wherever it is

why is this server contacting clients in our network?
seems like a spyware or virus issue but the client i'm testing on here is clean, as far as i can tell

**bilbus** · 03-16-2009, 02:45 PM

dhcp is is broadcast based, does nto matter what it's ip is. When you ask for a ip address with dhcp, you have no ip address (see) so you send out a broadcast.

Change your ip to 8.255.0.1 and try to ping it.

If you can ping it you can find it

If you are a small office where you can unplug stuff, it will be easy to find. When you can no longer ping it after unpluging you know its on that port / switch.

If you are in a large office that you cant .. you will have to make a vlan with your self in it. And then add all the ports for the local switch, if cant ping it, add a second switch to the vlan, and a thirtd, untill you can. Now you know what switch it is. Move to that switch, vlan again add half the ports .. and keep narrowing it down.

Once you find the port you can look up the location and walk there.

Idealy, you want to vlan all of your desktop ports .. so they can not talk to other desktops.

So say switch 1 is all desktops. All switch ports can talk to port 24 (the uplink to the main switch) but 1-23 can not talk to each other.

nvisibl · 03-17-2009, 03:03 AM

when i change my IP to 8.255.0.1 in order to ping the 8.255.0.0 address I get "destination address not valid". The vlan idea is good thanks, the walk round may be easier so will get to that today.

03-10-2009, 04:56 AM	#1 (permalink)
nvisibl Registered User Join Date: Jul 2008 Posts: 68 OS: Vista	some dhcp somewhere issuing incorrect ip info is there a way where i can tell from an XP client which DHCP server the client got its IP from? some of the clients are picking up incoorect dns info from somewhere and i can't yet locate whats causing it thanks for your help

03-10-2009, 09:06 AM	#2 (permalink)
johnwill Manager, Networking Forums Join Date: Sep 2002 Location: S.E. Pennsylvania, US Posts: 41,654 OS: Windows 7, XP-Pro, Vista, Linux Blog Entries: 1	Re: some dhcp somewhere issuing incorrect ip info Not really, you could try using something like WireShark to monitor the connection and see where the DHCP handshake comes from. __________________ If TSF has helped you, Tell us about it! or Donate to help keep the site up! Microsoft MVP - Windows Desktop Experience

03-10-2009, 11:12 AM	#3 (permalink)
djaburg TSF Enthusiast Join Date: May 2008 Posts: 1,319 OS: XP SP3/Vista/7 Server 2K/2K3/2K8	Re: some dhcp somewhere issuing incorrect ip info Is this a wireless network? __________________ Computers make it easier to do a lot of things, but most of the things they make it easier to do don't need to be done. The inherent vice of capitalism is the uneven division of blessings, while the inherent virtue of socialism is the equal division of misery.

03-10-2009, 11:42 AM	#4 (permalink)
Ghiyas Registered User Join Date: Mar 2009 Posts: 1 OS: xp	Re: some dhcp somewhere issuing incorrect ip info Even u can use the command ipconfig /all to view the dhcp server ip address

03-12-2009, 03:43 AM	#6 (permalink)
nvisibl Registered User Join Date: Jul 2008 Posts: 68 OS: Vista	Re: some dhcp somewhere issuing incorrect ip info ipconfig /all mentions the IP address of the DHCP server... would this then definately be the DHCP server from where the rest of the IP information came from? I take it that it is. The problem I have is that the clients are picking up an incorrect address for the primary DNS server. Should be 192.168.1.4 but instead its showing up as 192.168.1.1 My DHCP server runs on the same 192.168.1.4 server, and this is the DHCP server address that shows up on the clients when I do an ipconfig On double checking the DHCP scope on the server the DNS server address is the correct one 192.168.1.4 so I don't understand how the clients are sporadicaly picking up 192.168.1.1 especially if it comes from the correct DHCP server on 192.168.1.4 The clients are configured to obtain their IP address and DNS from DHCP, so there is no static DNS entries on the clients within the IP properties page.

03-12-2009, 05:39 AM	#7 (permalink)
nvisibl Registered User Join Date: Jul 2008 Posts: 68 OS: Vista	Re: some dhcp somewhere issuing incorrect ip info hmmmmmm... something strange seems to be going on just done a brand new XP build as per our standard build, it was connecting to the web okay etc... as it should and so had retrieved the correct IP info from the DHCP server which includes the primary DNS of 192.168.1.4 the dhcp lease time = 1 week without having switched off the pc or messed about with any settings IP or otherwise i noticed that i couldn't connect to the web all of a sudden. and so on checking the ip details as a result of this i noticed the cause being that the primary DNS setting had changed to this incorrect address of 192.168.1.1 strange or what?

03-13-2009, 06:26 AM	#8 (permalink)
clyde123 Registered User Join Date: Apr 2008 Location: Glasgow Posts: 397 OS: xp sp2	Re: some dhcp somewhere issuing incorrect ip info If this 192.168.1.4 should never change, just configure that into the Internet Connection as a fixed number for the DNS server.

03-13-2009, 06:35 AM	#9 (permalink)
nvisibl Registered User Join Date: Jul 2008 Posts: 68 OS: Vista	Re: some dhcp somewhere issuing incorrect ip info thank you and sure its the most viable workaround but doesn't answer the root issue and plus makes things less dynamic

03-13-2009, 08:35 AM	#10 (permalink)
djaburg TSF Enthusiast Join Date: May 2008 Posts: 1,319 OS: XP SP3/Vista/7 Server 2K/2K3/2K8	Re: some dhcp somewhere issuing incorrect ip info Well my question still remains unanswered...is this a wireless network? If it's not, then you MUST have another device on the network acting as a DHCP server. Get a utility like lookatlan and have it scan. __________________ Computers make it easier to do a lot of things, but most of the things they make it easier to do don't need to be done. The inherent vice of capitalism is the uneven division of blessings, while the inherent virtue of socialism is the equal division of misery.

03-13-2009, 10:20 AM	#11 (permalink)
nvisibl Registered User Join Date: Jul 2008 Posts: 68 OS: Vista	Re: some dhcp somewhere issuing incorrect ip info excuse for not before responding djaburg.... its a wired network.. i have lookatlan but not sure it can help other than by giving a general list of network nodes the thing that puzzles me is that the DNS ip seems to change automatically without my rebooting or messing with the IP config. it changes even though the dhcp lease is set to 1 week

03-14-2009, 03:25 PM	#12 (permalink)
bilbus TSF Enthusiast Join Date: Aug 2006 Posts: 949 OS: OS2 Warp	Re: some dhcp somewhere issuing incorrect ip info ... ipconfig /all will list the dhcp server, and its IP. You can use dhcpfind, its a free downloadable tool. It will list all the dhcp servers on your subnet, if you have relay agents, it will also show dhcp servers on a remote subnet. I can tell you what the problem is, somone hooked up their home router to your network, and it's dhcping addresses. I bet they wanted to use wifi.

03-16-2009, 02:52 AM	#13 (permalink)
nvisibl Registered User Join Date: Jul 2008 Posts: 68 OS: Vista	Re: some dhcp somewhere issuing incorrect ip info dhcpfind sounds handy thabnks will go look for it now if a client has a dhcp assigned IP config from a dhcp server with a lease time of 1 week, is it possible that client can obtain ip info from another dhcp server in the interim, even though the original lease remains current? this without the client being rebooted or reconfigured in any way.

03-16-2009, 02:59 AM	#14 (permalink)
bilbus TSF Enthusiast Join Date: Aug 2006 Posts: 949 OS: OS2 Warp	Re: some dhcp somewhere issuing incorrect ip info Yup, wont be a problem you may have to ipconfig /release, ipconfig /renew

03-16-2009, 04:03 AM	#15 (permalink)
nvisibl Registered User Join Date: Jul 2008 Posts: 68 OS: Vista	Re: some dhcp somewhere issuing incorrect ip info thanks but its not the IP onfo that needs changing, i'm trying to find out why the clients after picking up correct DHCP info are after a while picking up incorrect DNS info. this without the client being rebooted or my doing an ipconfig /release. i find it most puzzling, and wonder if its correct behaviour that a dhcp client should let go of its lease and pick up another even when the lease hasn't expired, and the machine hasn't been rebooted or initial IP released

03-16-2009, 04:08 AM	#16 (permalink)
bilbus TSF Enthusiast Join Date: Aug 2006 Posts: 949 OS: OS2 Warp	Re: some dhcp somewhere issuing incorrect ip info It will ask for a new ip every time it boots up. Usualy it will recieve the same ip, and won't change. If it gets a new IP, it should change it. What dns information is wrong? server or workstation A recods?

03-16-2009, 05:55 AM	#18 (permalink)
nvisibl Registered User Join Date: Jul 2008 Posts: 68 OS: Vista	Re: some dhcp somewhere issuing incorrect ip info Okay... running dhcpfinder on a client and it reports that a DHCP server with address 8.255.0.0 is sending packets to it we operate a 192 network... and i am also unable to ping this 8.255.0.0. server wherever it is why is this server contacting clients in our network? seems like a spyware or virus issue but the client i'm testing on here is clean, as far as i can tell

03-16-2009, 02:45 PM	#19 (permalink)
bilbus TSF Enthusiast Join Date: Aug 2006 Posts: 949 OS: OS2 Warp	Re: some dhcp somewhere issuing incorrect ip info dhcp is is broadcast based, does nto matter what it's ip is. When you ask for a ip address with dhcp, you have no ip address (see) so you send out a broadcast. Change your ip to 8.255.0.1 and try to ping it. If you can ping it you can find it If you are a small office where you can unplug stuff, it will be easy to find. When you can no longer ping it after unpluging you know its on that port / switch. If you are in a large office that you cant .. you will have to make a vlan with your self in it. And then add all the ports for the local switch, if cant ping it, add a second switch to the vlan, and a thirtd, untill you can. Now you know what switch it is. Move to that switch, vlan again add half the ports .. and keep narrowing it down. Once you find the port you can look up the location and walk there. Idealy, you want to vlan all of your desktop ports .. so they can not talk to other desktops. So say switch 1 is all desktops. All switch ports can talk to port 24 (the uplink to the main switch) but 1-23 can not talk to each other.

03-17-2009, 03:03 AM	#20 (permalink)
nvisibl Registered User Join Date: Jul 2008 Posts: 68 OS: Vista	Re: some dhcp somewhere issuing incorrect ip info when i change my IP to 8.255.0.1 in order to ping the 8.255.0.0 address I get "destination address not valid". The vlan idea is good thanks, the walk round may be easier so will get to that today.