Odd DHCP behavior (Vista losing IP?)

Wed Apr 14 14:06:58 UTC 2010

Hi Jason,

I have the exact same problem here, but I don't have Vista PCs on the campus. The same problem appends with a lot of XP machines and I can't reproduce it in lab... 

Are you sure the problem is your DHCP server? After several tests and captures I'm starting to think it's related to our cisco routers (4506) security configuration, but I'm not sure yet... We use DHCP_SNOOPING and IP_SOURCE_GUARD on every network port that have this behavior. When a PC loses his IP and get a 169.254.x.x IP, if I remove the security on the port, everything return to normal... 

My logs are different:

Apr  6 14:36:17 : DHCPDISCOVER from 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:36:17 : DHCPOFFER on 10.48.107.170 to 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:36:24 : DHCPDISCOVER from 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:36:24 : DHCPOFFER on 10.48.107.170 to 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:36:24 : DHCPREQUEST for 10.48.107.170 (192.168.10.10) from 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:36:24 : DHCPACK on 10.48.107.170 to 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:38:56 : DHCPREQUEST for 10.48.107.170 from 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:38:56 : DHCPACK on 10.48.107.170 to 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:39:02 : DHCPREQUEST for 10.48.107.170 from 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:39:02 : DHCPACK on 10.48.107.170 to 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:39:22 : DHCPREQUEST for 10.48.107.170 from 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:39:22 : DHCPACK on 10.48.107.170 to 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:39:22 : DHCPREQUEST for 10.48.107.170 from 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:39:22 : DHCPACK on 10.48.107.170 to 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:40:03 : DHCPDISCOVER from 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:40:03 : DHCPOFFER on 10.48.107.170 to 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:40:08 : DHCPDISCOVER from 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:40:08 : DHCPOFFER on 10.48.107.170 to 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:40:18 : DHCPDISCOVER from 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:40:18 : DHCPOFFER on 10.48.107.170 to 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:43:52 : DHCPREQUEST for 10.48.107.170 (192.168.10.11) from 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1
Apr  6 14:43:52 : DHCPACK on 10.48.107.170 to 00:13:72:12:b7:bb (Dell-AVR06-02) via 10.48.107.1

I tried updating to the latest cisco IOS... I had one problem after that. I will continue my investigation.

I hope this can help,

Denis

-----Message d'origine-----
De : dhcp-users-bounces+denis_laventure=uqac.ca at lists.isc.org [mailto:dhcp-users-bounces+denis_laventure=uqac.ca at lists.isc.org] De la part de Jason Frisvold
Envoyé : 14 avril 2010 09:13
À : dhcp-users at lists.isc.org
Objet : Re: Odd DHCP behavior (Vista losing IP?)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On 04/14/2010 09:04 AM, Glenn Satchell wrote:
> Do you have other Vista PCs on the network that work correctly? Try to
> see if it is something specific to Vista everywhere, or something about
> this Lab subnet.

There are a fair number of Vista machines on the network, but we only
have complaints from this particular lab.  I do see similar behavior for
a handful of other machines on the network, some of the XP machines, but
it's scattered and by no means consistent.  This lab is almost perfectly
consistent.

> Can you use snoop, tcpdump or perhaps wireshark to capture the
> DHCPINFORM packets? Looks like there is some piece of information the PC
> needs and it keeps requesting it. Look at the options being requested -
> you may need to send back a dummy value or change a setting.

Sure, I'll get something set up to capture the data.  I suppose this
isn't something "common" that I'm overlooking, so I'll have to dig a bit
deeper..

Thanks,

> regards,
> -glenn

- -- 
- ---------------------------
Jason Frisvold
Network Engineer
frisvolj at lafayette.edu
- ---------------------------
"What I cannot create, I do not understand"
   - Richard Feynman
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.13 (GNU/Linux)
Comment: Using GnuPG with Fedora - http://enigmail.mozdev.org/

iEYEARECAAYFAkvFv04ACgkQO80o6DJ8UvkqxQCfXTVVmvGXq0gU59XgqFv+yV6R
MPoAn3x1M97cvptq9JpSPIC1IKsLRdNz
=mdCu
-----END PGP SIGNATURE-----
_______________________________________________
dhcp-users mailing list
dhcp-users at lists.isc.org
https://lists.isc.org/mailman/listinfo/dhcp-users