Win XP discover/offer/req/ack loop (Help!)

Sten Carlsen sten at s-carlsen.dk
Mon Aug 28 21:19:52 UTC 2006


Ooops, is it free of hazardous substances? Have you placed a reasonable
warning sign for users of the pool? :-P :-! :-X

Amazing how big consequences one rogue device will do; one lesson to learn.

Jeff A. Earickson wrote:
> On Thu, 24 Aug 2006, David W. Hankins wrote:
>
>   
>> Date: Thu, 24 Aug 2006 14:35:33 -0700
>> From: David W. Hankins <David_Hankins at isc.org>
>> Reply-To: dhcp-users at isc.org
>> To: dhcp-users at isc.org
>> Subject: Re: Win XP discover/offer/req/ack loop (Help!)
>>
>> On Thu, Aug 24, 2006 at 04:44:37PM -0400, Jeff A. Earickson wrote:
>>     
>>> Do you mean tcpdump from the ISC DHCP server, or some networky
>>> packet sniffer on the 202 subnet?  Our network guy is contemplating
>>> the idea that somebody attached a rogue dhcp/wireless/NAT device
>>> to the 202 subnet and disrupted traffic there.  This issue just
>>> started today.  Since it is near the start of school, new people
>>> and new devices are showing up on our network...
>>>       
>> Considering your next most recent message, I think that is highly
>> likely.  Someone has probably installed a dhcp server that gives
>> out the 192.168.0.x addresses, and because it is closer to the
>> clients than your dhcp server, the clients are selecting that
>> server's OFFERs (hence no visible REQUEST).
>>
>> I recommend copious use of an aluminium bat.  They're young,
>> they'll heal.  Wrapping the bat in cloth and bathing it in
>> broken glass is probably unwarranted, but also highly satisfying.
>>     
>
> Just to close this one out, our network guy found a rogue device
> in the office of the swim coach.  The device is now a boat anchor
> at the bottom of his pool.
>
> thanks to all, 
> Jeff Earickson
> Colby College
>
>   

-- 
Best regards

Sten Carlsen

No improvements come from shouting:

       "MALE BOVINE MANURE!!!" 



More information about the dhcp-users mailing list