Interesting Windows 2000 Issue

Posted on 2006-04-04
Last Modified: 2010-03-19

We have a client who runs a Windows 2000 ISA server (runs 2000 server and ISA 2000).  This server of course has 2 NICs, one for outside and one for inside.

Just a week ago, she said that when she came in, her NICs had lost their static IP address assignments and were showing the default IP assignment (169.x.x.x, you know what I mean).  Of course this means that the NICs could not get any DHCP addresses.

So she put the Static IPs back on, but here is the issue.  The ISA IP filtering logs show that UDP port 67 and 68 are being blocked (source IP of the server and dest. is the broadcast address) constantly, those ports are used for DHCP.  It appears that the NICs are still trying to get DHCP addresses?

My question first is, how is it that the NICs could lose their Static IPs like that?  The woman insists that there was no way anyone had access to the server over that weekend, so it must of been some kind of failure.

My second question is, why would it seem that the server is still trying to get DHCP addresses?  Has anyone come across this before?  These blocked packets only started appearing after the odd server error mentioned above.

Thanks for the input.
Question by:TheTull
    LVL 8

    Accepted Solution

    I am guessing, but I think your TCP/IP stack got hosed. My simple solution is remove TCP/IP from the server. Restart, Add TCP/IP back and reconfigure the NIC settings. I also highly recommend that if you don;t have the complete settings written down somewhere you do that as soon as possible.

    LVL 7

    Author Comment

    Not a bad idea, I also assumed something corrupt happened with the windows side of things, whether the TCP/IP stack froze up or what.  I would still like to know for sure what caused it, but we may never find out.
    LVL 12

    Assisted Solution

    If it is some kind of hardware cause corruption, you might want to scandisk the HD. Another thing you might want to do is reinst sp4 to make sure core files arnt corrupt.
    LVL 12

    Expert Comment


    Any luck resolving this?
    LVL 7

    Author Comment

    Well, I left the problem in the hands of the original IT person working on it.  And actually I took a new job, so I won't even be able to work on that issue if I wanted to, but thanks for the help, I will distribute the points.

    Featured Post

    Enabling OSINT in Activity Based Intelligence

    Activity based intelligence (ABI) requires access to all available sources of data. Recorded Future allows analysts to observe structured data on the open, deep, and dark web.

    Join & Write a Comment

    If your business is like most, chances are you still need to maintain a fax infrastructure for your staff. It’s hard to believe that a communication technology that was thriving in the mid-80s could still be an essential part of your team’s modern I…
    If you're not part of the solution, you're part of the problem.   Tips on how to secure IoT devices, even the dumbest ones, so they can't be used as part of a DDoS botnet.  Use PRTG Network Monitor as one of the building blocks, to detect unusual…
    Get a first impression of how PRTG looks and learn how it works.   This video is a short introduction to PRTG, as an initial overview or as a quick start for new PRTG users.
    In this tutorial you'll learn about bandwidth monitoring with flows and packet sniffing with our network monitoring solution PRTG Network Monitor ( If you're interested in additional methods for monitoring bandwidt…

    733 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now