[Okta Webinar] Learn how to a build a cloud-first strategyRegister Now

x
?
Solved

Windows Server 2008 stealing DHCP leases?

Posted on 2009-02-16
16
Medium Priority
?
1,315 Views
Last Modified: 2012-05-06
Hi,

I have a simple network in my office with routing instead of NAT, so my office is all covered with public IP addresses, which I have 16 available from my ISP. This configuration is working fine for few years now and is also quite fine protected with Cisco routers.
But it's not the problem here.

The problem arises from my lazines, because I was tired of manually setting IP properties for each machine I brought into office for repair. So I setup my Cisco to serve as DHCP for internal "LAN". DHCP was properly configured and allowed to deliver 2 IP addresses from public range.

Even this would in principle NOT be a problem, unless...
...unless my main Windows 2008 Server would not begin stealing DHCP leases.

I do not understand HOW, but a fect is, that Cisco shows 2 DHCP leases, both delivered to MAC address of my Windows 2008 NIC, but if I type ipconfig /all, I do not see these IP's designated to this particular NIC. See here:
------------------
On my router:
------------------
DHCP ClientsHost Name IP Address MAC Address Client Lease Time
VIPER5        xxx.212.81.27         00:15:17:6F:5E:08        0 days       02:00:00  
*                 xxx.212.81.28         00:15:17:6F:5E:08        0 days        02:00:00

------------------------------------------
On my Windows Server (VIPER5):
------------------------------------------
Ethernet adapter LAN Browse:

   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) PRO/1000 PT Server Adapter
   Physical Address. . . . . . . . . : 00-15-17-6F-5E-08
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   Link-local IPv6 Address . . . . . : fe80::d816:e214:bb96:91a5%17(Preferred)
   IPv4 Address. . . . . . . . . . . : xxx.212.81.24(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.240
   Default Gateway . . . . . . . . . : xxx.212.81.17
   DNS Servers . . . . . . . . . . . : xxx.212.81.20
   NetBIOS over Tcpip. . . . . . . . : Enabled

If I delete these DHCP leases, server requests them both and Cisco delivers IP's back to it in few seconds.
I do not understand - which mechanism on Windows Server 2008 acts like this? DHCP is dicabled on all NIC adapters and actually it was never ever even enabled, because all IP's in my office are static and have never been on DHCP.
If I remember correct, this configuration was working some time ago, which means, that my Windows 2008 box did not behave like this all the time.

Any idea how to stop this DHCP client?
0
Comment
Question by:Andrej Pirman
  • 8
  • 4
  • 2
  • +1
16 Comments
 
LVL 23

Expert Comment

by:debuggerau
ID: 23655445
dual adaptors? Virtual Machines?
0
 
LVL 15

Expert Comment

by:wantabe2
ID: 23655462
So you are saying you can set static IPs on the NIC & on the router you see new leases to the NIC with static IPs...
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 23655535
Disable IPv6 on the nic
0
VIDEO: THE CONCERTO CLOUD FOR HEALTHCARE

Modern healthcare requires a modern cloud. View this brief video to understand how the Concerto Cloud for Healthcare can help your organization.

 
LVL 18

Author Comment

by:Andrej Pirman
ID: 23655551
Dual NICs?
Yes, I have 3 NIC's in my server, but only 1 with this particular MAC address, so other NIC's are irellevant in this case.

Virtual machines?
Nope, I disabled VM support in BIOS and also uninstalled Hyper-V role.

Yes, my NIC's all have STATIC IP's, and I see DHCP leases on my router. Thats strange.
Also:
- none of leased IP's respond to PING
- if I scan those DHCP leased IP's, nothing responds on any port
- If I pull off the cable from this particular NIC with this particular MAC address, then both DHCP leases dissapear. Which means, that NICs are actually sending out DHCP requests!
0
 
LVL 15

Expert Comment

by:wantabe2
ID: 23655577
I think you may be seeing just the leases expiration time/date on the router since you can't ping them. That has to be it.
0
 
LVL 18

Author Comment

by:Andrej Pirman
ID: 23655713
Nope.
Unfortunatelly, there must be something else. DHCP leases re-appear few seconds after I delete them, so definitelly there is some DHCP request, not just lease expiration.

Also, I noticed something weird.
Let's name this NIC, which is stealing DHCP, NIC1.
If only NIC1 is connected, there are NO DHCP leases!
But as soon as I plug-in the second NIC2, at this moment NIC1 (yes, NIC1) imidiatelly receives 2 IP addresses via DHCP??!!
0
 
LVL 59

Expert Comment

by:Darius Ghassem
ID: 23656726
Have you disabled IPv6?
0
 
LVL 18

Author Comment

by:Andrej Pirman
ID: 23661083
Nope, IPv6 is not disabled.
Let me try...

No, no difference. I disabled IPv6 on all NIC's, reset DHCP on router, but lease appears immidiatelly after I reset DHCP. I can only disable DHCP lease if I disconnect 2nd NIC adapter, like this:

**** START TESTING ****

NIC1 --------X

NIC2 --------X

 (no DHCP leases)



**** STEP 1 ****

NIC1 ----------> router

NIC2 --------X

 (no DHCP leases)



**** STEP 2 ****

NIC1 ----------> router

NIC2 ----------> router

 (NIC1 receives IP from router via router's DHCP)
0
 
LVL 23

Expert Comment

by:debuggerau
ID: 23666056
have you checked the DHCP server for any reservations?
They apply at the MAC layer, so when that MAC is presented to the network, it allocates an IP...
0
 
LVL 18

Author Comment

by:Andrej Pirman
ID: 23668372
No, there are no reservations on DHCP on router.

I also double-checked if there are any other DHCP in my network, so I switched OFF all other machines, except my main server....but this server still receives DHCP from router.

I think the main problem is in Windows 2008 technology, actually, how it handles NIC cards.
0
 
LVL 23

Expert Comment

by:debuggerau
ID: 23676855
what roles in the windows 2008 server running currently? DHCP server?


could you post a "ipconfig /all" results with the server completely disconnected?

0
 
LVL 18

Author Comment

by:Andrej Pirman
ID: 23706613
My 2008 server does NOT have DHCP role.
Only my router has DHCP to serve wireless clients.
Server has static IP on all interfaces.

If I alter DHCP rang on router, no matter what, server 2008 steals ALL IP's available, all leased to same server's MAC address 00:15:17:6F:5E:08

Here is ipconfig /all:
Microsoft Windows [Version 6.0.6001]
Copyright (c) 2006 Microsoft Corporation.  All rights reserved.
 
C:\Users\Andrej>ipconfig /all
 
Windows IP Configuration
 
   Host Name . . . . . . . . . . . . : VIPER5
   Primary Dns Suffix  . . . . . . . :
   Node Type . . . . . . . . . . . . : Hybrid
   IP Routing Enabled. . . . . . . . : Yes
   WINS Proxy Enabled. . . . . . . . : No
 
Ethernet adapter LAN Browse:
 
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) PRO/1000 PT Server Adapter
   Physical Address. . . . . . . . . : 00-15-17-6F-5E-08
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : xxx.212.81.24(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.240
   Default Gateway . . . . . . . . . : xxx.212.81.17
   DNS Servers . . . . . . . . . . . : xxx.212.81.20
                                       84.255.210.77
   NetBIOS over Tcpip. . . . . . . . : Enabled
 
Ethernet adapter LAN DNS + Local:
 
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Intel(R) 82566DM-2 Gigabit Network Connec
tion #2
   Physical Address. . . . . . . . . : 00-19-99-42-EB-1E
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv4 Address. . . . . . . . . . . : xxx.212.81.20(Preferred)
   Subnet Mask . . . . . . . . . . . : 255.255.255.240
   Default Gateway . . . . . . . . . :
   DNS Servers . . . . . . . . . . . : xxx.212.81.20
                                       84.255.210.77
   NetBIOS over Tcpip. . . . . . . . : Enabled
 
Tunnel adapter Local Area Connection* 8:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : isatap.{D679307E-4426-4101-AF85-E8F999841
58D}
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
 
Tunnel adapter Local Area Connection* 9:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
   Physical Address. . . . . . . . . : 02-00-54-55-4E-01
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
 
Tunnel adapter Local Area Connection* 11:
 
   Media State . . . . . . . . . . . : Media disconnected
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : isatap.{33F3A9FA-5B8D-4F81-8836-1E93644EA
926}
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
 
Tunnel adapter Local Area Connection* 12:
 
   Connection-specific DNS Suffix  . :
   Description . . . . . . . . . . . : 6TO4 Adapter
   Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
   DHCP Enabled. . . . . . . . . . . : No
   Autoconfiguration Enabled . . . . : Yes
   IPv6 Address. . . . . . . . . . . : 2002:59d4:5114::59d4:5114(Preferred)
   IPv6 Address. . . . . . . . . . . : 2002:59d4:5118::59d4:5118(Preferred)
   Default Gateway . . . . . . . . . : 2002:c058:6301::c058:6301
   DNS Servers . . . . . . . . . . . : xxx.212.81.20
                                       84.255.210.77
   NetBIOS over Tcpip. . . . . . . . : Disabled

Open in new window

0
 
LVL 18

Author Comment

by:Andrej Pirman
ID: 23706664
Found out something:

It has definitelly something to do with RRAS service!
If I disable RRAS on my Windows 2008 server, DHCP leases disappear on router!
0
 
LVL 23

Accepted Solution

by:
debuggerau earned 1500 total points
ID: 23706827
Ah yes, the remote access server, certainly this could be configured to use DHCP addresses.

If you use the wizard to configure, this other option (a range of addresses) may be more appropriate.

RRAS.JPG
0
 
LVL 18

Author Closing Comment

by:Andrej Pirman
ID: 31547597
Since sollution was actually found by me, only B grade.
0
 
LVL 18

Author Comment

by:Andrej Pirman
ID: 23709362
Or, in Windows 2008 case on already configured RRAS, this would be the correct setting to avoid using DHCP:
RRAS.jpg
0

Featured Post

How to Use the Help Bell

Need to boost the visibility of your question for solutions? Use the Experts Exchange Help Bell to confirm priority levels and contact subject-matter experts for question attention.  Check out this how-to article for more information.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Sometimes drives fill up and we don't know why.  If you don't understand the best way to use the tools available, you may end up being stumped as to why your drive says it's not full when you have no space left!  Here's how you can find out...
After seeing many questions for JRNL_WRAP_ERROR for replication failure, I thought it would be useful to write this article.
This tutorial will walk an individual through the steps necessary to join and promote the first Windows Server 2012 domain controller into an Active Directory environment running on Windows Server 2008. Determine the location of the FSMO roles by lo…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…
Suggested Courses

872 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question