Erratic IP address/DHCP Problems happening across the network

Posted on 2009-12-17
Last Modified: 2012-08-14

We are experiencing very erratic network problems which include the following list which may or may not have any relation to each other:

1) Users getting the pop up message that says "there is an IP address conflict with another system on the network."  They can still usually access the internet.

2) Users whose network just stops working.  They have an IP address, but they cant go anywhere.  Usually a /release /renew fixes it

3) When you open up the DHCP server manager, under Address Leases, where all of the computer names and ip address leases are listed, there are all these "bad addresses".  Under "name" where computer name is, it says BAD_ADDRESS and under Description it says This address is already in use.  There are a TON of these BAD_ADDRESSES in our DHCP leases.  

4) In the DHCP Logs there are a ton of entries like this:
31,12/16/09,01:26:30,DNS Update Failed,,testpc.domain.lan,-1,

I dont know how common these "fails" are.  I've never looked into a DHCP log before.
We restarted the DNS and DHCP service, and it is doing the same thing.  

5) There is one DNS Even log error from 12/15.  It is Event ID 4015 with a description:

The DNS server has encountered a critical error from the Active Directory. Check that the Active Directory is functioning properly. The extended error debug information (which may be empty) is "". The event data contains the error.

6) Application log error: EventID 1004. Description: Reporting queued error: faulting application tcpsvcs.exe, version 5.2.3790.0, faulting module unknown, version, fault address 0x00000000.

I have never seen anything like this happen before.  About 1/4 of the company seems to be effected.  Nothing was changed recently to our servers.  Our lease time is 24 hours.

If there is any other info I can grab, please let me know!
Question by:mirchevsky
    LVL 39

    Accepted Solution

    Are there more that one DHCP server active in the network?
    are there fixed addresses used by some systems that overlap the DHCP address range?

    If a system detects it's address as being used it is required to instantly shut up and release a rental (DHCP) address.  So every time one address is doubly used one system goes down. timing decides which one.
    LVL 12

    Assisted Solution

    Do you have a large enough scope to handle the PC's on the LAN?

    We have noticed that the BAD_ADDRESSES on our LAN are related to iPhones and other smart phones that grab IP addresses and then do not release them properly. They generally are wiped out within a few days and released again. Most likely, your BAD_ADDRESSES are being held so you are being limited by the number of DHCP addresses you can hand out, hence the duplicate IP addresses.

    I suggest changing the lease time to something less that 24 hours if you have a lot of smart phone users grabbing IP addresses.
    LVL 2

    Assisted Solution

    Have you looked into conflict detection on the scope? have had a similar problem this helped, but didnt fix entirely.

    If your going to shortern the scope for the dubious devices using dhcp i would look into having a user class for your desktops.

    last of all do you have any VOIP on your network?

    Author Closing Comment

    Although not 100% sure the cause, I think all comments were very likely causes.  There werent any other DHCP server or added routers (we also had VLANs, so additional DHCP servers would have been extremely unlikly), but i think there were some overlapping IP addresses as well as a few smart phones.  After deleting all of the bad addresses and resolving some possible overlaps, Only one BAD Address showed up in DHCP in a week.  Thanks folks!!!!!!!

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    Join & Write a Comment

    Suggested Solutions

    Article by: rfc1180
    The Maximum Segment size (MSS) is an important consideration when troubleshooting connectivity via the Internet/Intranet. As the packets are routed via the Internet/Intranet, the packets must traverse through multiple routers in the path between two…
    A Cisco router can be configured as a DHCP Server. There are advantages and disadvantages in making your Cisco router work as DHCP Server. Almost all the features for windows DHCP can be configured on Cisco-based DHCP server. Some of the features me…
    In this seventh video of the Xpdf series, we discuss and demonstrate the PDFfonts utility, which lists all the fonts used in a PDF file. It does this via a command line interface, making it suitable for use in programs, scripts, batch files — any pl…
    Polish reports in Access so they look terrific. Take yourself to another level. Equations, Back Color, Alternate Back Color. Write easy VBA Code. Tighten space to use less pages. Launch report from a menu, considering criteria only when it is filled…

    728 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    18 Experts available now in Live!

    Get 1:1 Help Now