DHCP pool filling up - Windows 2003 Server : Scope is 100 percent full with only 0 IP addresses remaining

the server should have a static ip address not dhcp. you can set a reservation or take it out of the pool

02.18.2008 at 08:42AM PST, ID: 20921339

Rank: Master

1. either some unauthorized people use your network (examine MAC addresses)
2. Or the lease time is still long. Make it 6 hours just to see if it helps.
3. If you have really only 10 clients, try to make DHCP reservations for them. If you have pool of 10 IPs and 10 reservations, no one else will retrive the IP except the computers you explicitly want to retrieve it.
4. Also try to reconcile the scope - the problem maybe also here. I'd examine the logs more thoroughly - especially the daily DHCP logs.

02.18.2008 at 08:49AM PST, ID: 20921400

maxis:
The server is set to a static IP address in TCP/IP properties. I don't know how it would be using DHCP like that, but can you elaborate on "taking it out of the pool"?

I don't see where you can exclude a particular machine from obtaining a lease.
Thanks

02.18.2008 at 08:52AM PST, ID: 20921423

Martin:
I don't see the MAC addresses in the console, but I will examine the logs like you said. Are the MAC addresses listed there? Maybe you have something with the "unauthorized users" part.

02.18.2008 at 08:53AM PST, ID: 20921445

it the server ip address is 10.10.10.2 then you can exclude the range from 10.10.10.2-10.10.10.4 and start the ip pool at 10.10.10.5-10.10.10.9 say for 5 ip addresses.

there is an exclusion in the dhcp scope.

02.18.2008 at 08:59AM PST, ID: 20921505

Rank: Master

Exlusion range must be within the IP range, for example you have IP range 10.0.0.1 to 10.0.0.50
Then the Exclusion range can be something like 10.0.0.1 to 10.0.0.10 (generally it's first 10 IP adresses of the pool to keep them reserved for new servers or network devices that need to have static IP).
you will find the DHCP log on C:\Windows\System32\DHCP and the log files have names accoring to days of the week. You will see exactly to which device was leased which IP and when it happened. At the beginning of each log file there is a explanation what each particular event ID means.

Accepted Solution

02.18.2008 at 09:20AM PST, ID: 20921695

Reconciled the scope, it said "database consistent.

Looking over the logs, I see a lot of renewals taking the entire range around 3:15 AM on a regular basis.

The entries look sort of like this, is that the device at the end?

11,02/18/08,03:15:13,Renew,###.##.###.##,computer.domain.com,52415320000A5E435018000006000000

02.18.2008 at 09:23AM PST, ID: 20921731

i would go back to the exclusions and try that first before i started going crazy with the logs.

02.18.2008 at 09:27AM PST, ID: 20921762

Exclusions are set on either side of the ten addresses we want to be assigned dynamically, e.g., 10.0.0.1 - 10.0.0.59, then 10.0.0.71 - 10.0.0.254 are excluded. That leaves the 10.0.0.60 through 70 open. That's actually eleven. But that part does seem to be set up right I guess.

02.18.2008 at 09:31AM PST, ID: 20921798

Rank: Master

ok but why do you do it this way? if you want to have 10 IPs available to be leased, just create the IP range for example 10.0.0.1 to 10.0.0.20.
then create exclusion range 10.0.0.1 to 10.0.0.10 <- these will be in the range but never assigned by DHCP.
Kindly check all of your network devices, make some inventory, consider which of them should have dynamic and which static IP's. Maybe tae a piece of paper, write all the MAC adresses of authorized devices down and compare it to the list of MACs that get the IPs from your server. If you find some rogue devices, remove/reconfigure them.

02.18.2008 at 09:33AM PST, ID: 20921811

it shoud be 10.0.0.1-10.0.0.254 as the range then 10.0.0.71-10.0.0.254 excluded.

02.18.2008 at 09:43AM PST, ID: 20921892

I wasn't here when it was set up but I'm guessing it has something to with the static IPs that were already in use. I think the range of the dynamically assigned numbers needs to stay from .60 to .70, or I will need to go around and change everybody's static IPs. Could do that.

Right now I'd like to see if that MAC address that keeps showing up is in fact the server itself.

The entries look like this
.66,{host name},52415320000A5E435018000006000000,
.60,{host name},52415320000A5E435018000000000000,
.61,{host name},52415320000A5E435018000001000000,
.62,{host name},52415320000A5E435018000002000000,
.63,{host name},52415320000A5E435018000003000000,
.64,{host name},52415320000A5E435018000004000000,
.65,{host name},52415320000A5E435018000005000000,
.67,{host name},52415320000A5E435018000007000000,
.68,{host name},52415320000A5E435018000008000000,
.69,{host name},52415320000A5E435018000009000000,

Is that whole last part the MAC address? because it does change just slightly as it goes.

02.18.2008 at 09:48AM PST, ID: 20921931

I see the actual MAC address given in there, 000A5E435018, just wasn't sure what the rest of that was.

02.18.2008 at 09:56AM PST, ID: 20921988

Kind of a strange thing in the logs as well, I see one of our local workstations showing up routinely. No one over here is supposed to be using DHCP. I walked over and checked his configuration - he had static set up BUT there was another network configuration pointing to relakks (a 'darknet' in Sweden)? This connection was configured to use DHCP. He says he doesn't know what it is, so I deleted the relakks connection. Since then I also cleared the the extra leases that were not in use, and that guy's workstation shows up with a new assignment anyway!

I've got him running some scans right now but who knows what's going on there.

02.18.2008 at 09:57AM PST, ID: 20921997

it should look like this
11 8/24/00 00:00:58 Renew xxx.xxx.xx.xxx Acme.domain.com 00xxxxxxxxxx

here is the description
Event ID Meaning
-------------------
00 The log was started.
01 The log was stopped.
02 The log was temporarily paused due to low disk space.
10 A new IP address was leased to a client.
11 A lease was renewed by a client.
12 A lease was released by a client.
13 An IP address was found to be in use on the network.
14 A lease request could not be satisfied because the scope's address pool was exhausted.
15 A lease was denied.
16 A lease was deleted.
17 A lease was expired.
20 A BOOTP address was leased to a client.
21 A dynamic BOOTP address was leased to a client.
22 A BOOTP request could not be satisfied because the scope's address pool for BOOTP was exhausted.
23 A BOOTP IP address was deleted after checking to see that it was not in use.
50+ Codes above 50 are used for Rogue Server Detection information.

02.18.2008 at 10:26AM PST, ID: 20922206

Thanks maxis. I saw that at the top of the log, they're number 11s. That's how I knew they were renewals. Well, that and the fact the word "renewal" was included in each entry.

I just don't see how the server is listed there, and in the address leases since it's not set up to use DHCP itself.

02.18.2008 at 12:19PM PST, ID: 20923086

Thanks for all the help so far - I'd still like to know how the server that's running DHCP is obtaining a lease when it is not configured to actually use DHCP itself.

The whole exclusion thing seems to determine what addresses will be assigned to whoever requests one, but it doesn't explain why a server that doesn't even use DHCP is still obtaining a lease.

The logs showed me even more problems than I knew I had, but still no explanations.

I looked over all the network devices that I could, everyone seems to be configured the way they should be, except that one workstation with the whole relakks thing on it. That's pretty fishy and it's going to take me a while to figure what's up there.

Meanwhile, any thoughts on why that DHCP server keeps taking leases that it should not take in the first place would be greatly appreciated.

Thanks.

02.18.2008 at 12:25PM PST, ID: 20923126

Rank: Master

Regarding the server - go to command prompt, type in "ipconfig".
Do you see some more network interfaces? If not, configure the one you have from command line like that:
netsh interface ip set address name="Local Area Connection" source=static addr=10.0.0.1 mask=255.0.0.0
(in the line above change just the "Addr" and "mask" to the numbers you need. The same about "addr" in the line below.)

netsh interface ip set dns name="Local Area Connection" source=static addr=10.0.0.1

02.18.2008 at 12:36PM PST, ID: 20923209

Thanks Martin -
IPCONFIG shows:
PPP adapter RAS Server (Dial In) Interface:
Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 10.0.0.69
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :

Ethernet adapter Local Area Connection 2:
Connection-specific DNS Suffix . :
IP Address. . . . . . . . . . . . : 10.0.0.10
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . : 10.0.0.1

Should I run the two lines below?:

netsh interface ip set address name="Local Area Connection 2" source=static addr=10.0.0.10 mask=255.255.255.0

netsh interface ip set dns name="Local Area Connection 2" source=static addr=10.0.0.10

02.18.2008 at 01:47PM PST, ID: 20923775

Martin: That RAS entry that I saw when you had me check IPCONFIG got me thinking, so I looked in "routing and remote access". Under "Ports", WAN Miniport (PPTP) is used by RAS with a total of ten ports. I don't know enough about all this, but it seems like quite a coincidence that 10 is also the number of DHCP leases tied up by that server - maybe it does that to keep the leases ready for incoming VPN users.

This could also explain how I get that "Scope is 100% full" message when that local workstation with problems uses up the eleventh lease.

If you can confirm that as a possibility, I'll award the points and move on to that guy's machine as the source of my problems.

Thanks

02.18.2008 at 03:42PM PST, ID: 20924545

that is definately a possibility, a will also bet that the nat is the ip of the server.

Assisted Solution

02.18.2008 at 03:44PM PST, ID: 20924553

also since the ip address is correct you should not have to run the netsh command.

02.18.2008 at 03:49PM PST, ID: 20924581

something else i thought of, do you have a router that is giving out ip adddress? that maybe the vpn users are getting the ip addres form that.

02.19.2008 at 07:08AM PST, ID: 20928968

Hi max
Our router isn't giving out any IPs, everything here is static except for the people who are coming in via VPN. As for the NAT, if I understand what you're saying, that's all taking place at the router.

Still, what I'm going to do is go look at all the logs since last night. That scope shows completely full now, so if any of our VPN clients have come in since then, I'll assume the RAS is holding those addresses and giving them to the VPN people. If I wanted to get rid of the error, I could extend the range of available addresses for DHCP - but I don't really want anyone locally taking any since we're all static. So I'll live with the error.

I'll get back soon with the results.

Thanks

02.19.2008 at 07:40AM PST, ID: 20929371