I have approximately 20 systems out of about 60 that lose their network connectivity at 10:26 AM every other Monday. I did a wireshark trace on 4 systems and they all show the same issue. They lose the current IP address and obtain a default 169.254.x.x address. Some (but not all) systems request a new addreess via DHCP shortly before reverting to 169.254. The DHCP lease is also only 2 days and the process works until every other Monday morning. Within seconds of losing the address they will submit a DHCP request while using the 169.254.x.x address and the valid DHCP / DC server will respond with a usable address. After which everything is back to normal.
I guess the biggest question is, what might cause multiple systems to simultaneously lose IP addresses, request and receive new addresses and continue without issues for another 2 weeks.
The only reasons that a PC would lose its IP address after having been assigned it via DHCP is would be:
1) The lease expired and the machine could not contact the DHCP server to renew it, or 2) The machine itself is releasing it for some reason and is unable to contact the DHCP server to renew it. 3) The machine is requesting to renew the address and the DHCP server is rejecting it.
A PC will attempt to renew its IP address halfway through the lease. Since your leases are 2 days, that means a request to renew will be made every single day. Since it only happens once every two weeks, it means that the DHCP server is going down for a period longer than 2 days every other week (unlikely), or some scheduled job on those PC's is releasing it for some reason. This can happen if the network settings are being played with by some application.
I do know that the leases are not set to expire and the server is not rejecting it and if the systems are releasing it there is no indication of that. One thing I am noticing in the trace is that the switch starts acting like a hub (forwarding all directed traffic to all ports) and then no return traffic reaches ports, as if the arp table were lost. Might this cause a nic to request a new lease? Devices also start to ping the gateway when connectivity begins getting limited.
Turns out the switch was resetting every other Monday morning due to the UPS. It was diffucult to troubleshoot since we had to rely on the client's decription of what was happening until we did a wireshark capture combined with the checking the uptime of several devices.
