Win XP discover/offer/req/ack loop (Help!)

[Jeff A. Earickson]

On Thu, 24 Aug 2006, David W. Hankins wrote:

> Date: Thu, 24 Aug 2006 14:35:33 -0700
> From: David W. Hankins <David_Hankins at isc.org>
> Reply-To: dhcp-users at isc.org
> To: dhcp-users at isc.org
> Subject: Re: Win XP discover/offer/req/ack loop (Help!)
> 
> On Thu, Aug 24, 2006 at 04:44:37PM -0400, Jeff A. Earickson wrote:
>> Do you mean tcpdump from the ISC DHCP server, or some networky
>> packet sniffer on the 202 subnet?  Our network guy is contemplating
>> the idea that somebody attached a rogue dhcp/wireless/NAT device
>> to the 202 subnet and disrupted traffic there.  This issue just
>> started today.  Since it is near the start of school, new people
>> and new devices are showing up on our network...
>
> Considering your next most recent message, I think that is highly
> likely.  Someone has probably installed a dhcp server that gives
> out the 192.168.0.x addresses, and because it is closer to the
> clients than your dhcp server, the clients are selecting that
> server's OFFERs (hence no visible REQUEST).
>
> I recommend copious use of an aluminium bat.  They're young,
> they'll heal.  Wrapping the bat in cloth and bathing it in
> broken glass is probably unwarranted, but also highly satisfying.

Just to close this one out, our network guy found a rogue device
in the office of the swim coach.  The device is now a boat anchor
at the bottom of his pool.

thanks to all, 
Jeff Earickson
Colby College