Clients keep sending DHCPDECLINE

[moffe at zz9.dk]

  Hi all

I forgot one more thing:

I am of the impression (I have got error reports from only two people 
even though I can see in the logs that it happens to many people) that 
it happens only on Windows vista (and possibly 7) only when waking up 
from hibernation.

Best regards
/Rasmus

Den 22-08-2010 21:33, moffe at zz9.dk skrev:
> Hi Marc
>
> Thank you for the suggestion. I am currently dumping arp traffic (of 
> course, now the problem does not show up!)
>
> I am unable to dump as:
>
> 1) It seems random which clients are affected,
> 2) I currently have no equipment at hand to dump
>
> It is a residential network, so people set up a multitude of 
> equipment, brands, models, configurations etc. so the problem might 
> come from almost anywhere. I am not aware that any proxy-arp equipment 
> is installed, but of course someone might have installed just about 
> anything. Rogue DHCP-servers happens often, but I am mostly on top of 
> these (one sending NAKs but not OFFERs would be unusual).
>
> I will try to get my hands on a two-NIC computer able to run tcpdump 
> to place between an affected computer and the network.
>
> If anyone else should have other suggestions in the meantime, I would 
> be very happy.
>
> Best regards and thank you
> /Rasmus
>
> Den 20-08-2010 15:57, Marc Perea skrev:
>> Hi Rasmus,
>> this problem can have a few different causes, but I remember having a 
>> similar issue when we had Vista attached to a Cisco relay agent on a 
>> router. After specific positioning of a packet capture to identify 
>> the behavior, Vista sends a gratuitous arp after the ACK as one final 
>> check to see if anyone else on the network has that IP before binding 
>> it to its interface for use. Unfortunately for us, our Cisco router 
>> was answering that arp with its own MAC, presumably identifying that 
>> the Cisco could get to that IP so it responded to the arp by proxy. 
>> We did a no ip proxy-arp on that interface and our router stopped 
>> responding to the g-arps, and things were quiet (and working).
>> Not sure if this is the case for you or not, but I'd at least get a 
>> sniff going just north of the client to see what situation is 
>> occurring that causes the client to DECLINE - delayed NAK perhaps 
>> from another piece of gear?
>> HTH -- Marc
>>
>> >Over the last months I have suddenly seen a behaviour, that is new to
>> >me:
>> >
>> >1) Client DHCPDISCOVERs
>> >2) Server DHCPOFFERs
>> >3) Client DHCPREQUESTs
>> >4) Server DHCPACKs
>> >5) Client DHCPDECLINEs
>> >6) Server abandons IP
>> >7) Goto 1, with new IP
>>
>>
>> _______________________________________________
>> dhcp-users mailing list
>> dhcp-users at lists.isc.org
>> https://lists.isc.org/mailman/listinfo/dhcp-users
>
>
> -- 
> Rasmus Bøg Hansen ||http://www.zz9.dk/
> moffe at zz9.dk       ||
>
>
> _______________________________________________
> dhcp-users mailing list
> dhcp-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/dhcp-users


-- 
Rasmus Bøg Hansen || http://www.zz9.dk/
moffe at zz9.dk      ||

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/dhcp-users/attachments/20100822/fddccc91/attachment.html>