Still celebrating National IT Professionals Day with 3 months of free Premium Membership. Use Code ITDAY17

x
?
Solved

Getting slammed with BAD_ADDRESS in DHCP

Posted on 2010-09-13
11
Medium Priority
?
1,259 Views
Last Modified: 2012-05-10
  Hello,
This morning I got a complain that a computer is not connecting to the network at one of my sites. Wghe I went there I realized that the PC cannot get IP address. When I went to the local DC and checked the DHCP I saw a lot of  BAD_ADDRESS records with strange MAC address: They were something like 4850006a, 4860006a, 4870006a, etc. and they were like 50 or more of them. I was checking the other DCs and everything looks fine. I have not changed anything on the DCs, just start happening.

I have 4 2008 DCs on three sites and they are in the same forest. Let me know if you need more info.

Please help.

Thank you,
Plamen
0
Comment
Question by:plamski
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 5
  • 4
  • 2
11 Comments
 
LVL 13

Expert Comment

by:Greg Hejl
ID: 33668022
can you get that computer to access the internet?  assign static address? what happened after reboot?  anything in the event logs relating to dhcp in client computer?

 the bad address is from the client.
0
 
LVL 9

Expert Comment

by:LaserSpot
ID: 33668178
I think MAC addresses starting in 48 are epson. Do you have some networked Epson printers or scanners?
0
 

Author Comment

by:plamski
ID: 33668573
0
Simplifying Server Workload Migrations

This use case outlines the migration challenges that organizations face and how the Acronis AnyData Engine supports physical-to-physical (P2P), physical-to-virtual (P2V), virtual to physical (V2P), and cross-virtual (V2V) migration scenarios to address these challenges.

 
LVL 9

Expert Comment

by:LaserSpot
ID: 33668802
I think you should update the BIOS and Ethernet driver on that PC.
0
 

Author Comment

by:plamski
ID: 33668853
Do you mean on the server? The server I have the DHCP has DNS and ACtive Directory running.
0
 
LVL 9

Expert Comment

by:LaserSpot
ID: 33668884
It's only one PC that can't connect, right? I think that PC is generating the bad DHCP requests; update the PC.

You could look in %windir%\System32\Dhcp on the server, maybe get the real MAC address and confirm that it's only one PC generating the bad requests.
0
 

Author Comment

by:plamski
ID: 33668903
They are acctually a few. And how this can happened on them at the same time?
DhcpSrvLog-Mon.log
0
 
LVL 9

Accepted Solution

by:
LaserSpot earned 1000 total points
ID: 33668966
You may have several PCs that are the same model and have the same problem. This may not have happened at the same time, you just noticed it because they filled all the DHCP leases.

What model PCs are they? I've seen Dell's with a BIOS bug cause system wide network problems.
0
 

Author Comment

by:plamski
ID: 33671960
I have Dell PCs but they are running Windows 7 and they are the only ones don't have problems. My XP machines are HP dx2200 and d220. The weird thing is that I removed the DHCP role from the server and even that I am putting static IP on the XP machine - NO LUCK - still tells me that there is duplicte IP on the network andI know that there is not.
0
 
LVL 13

Assisted Solution

by:Greg Hejl
Greg Hejl earned 1000 total points
ID: 33675848
http://support.microsoft.com/kb/325919

http://technet.microsoft.com/en-us/library/cc779267%28WS.10%29.aspx

one of your clients has gone rogue with it's MAC address - it's spitting out garbage and not communicationg with dhcp server.  dhcp is making a reservation and sending to bogus mac

0
 

Author Comment

by:plamski
ID: 33676214
I found the problem. It came from the Juniper router attached to the network. It was running 8.1 software on j2300 but is was becoming unaccessible. From juniper recommended to upgrade to higher version and after they did to v8.5 yesterday morning, one hour later I start seeing these problems. Downgraded to the previous version and everything is up and running. "Laser Spot", it was a good clue about the Dell motherboards and the BIOS, because Juniper use dell manufactured servers.

Thank you both for your support,

Plamen
0

Featured Post

Prepare for your VMware VCP6-DCV exam.

Josh Coen and Jason Langer have prepared the latest edition of VCP study guide. Both authors have been working in the IT field for more than a decade, and both hold VMware certifications. This 163-page guide covers all 10 of the exam blueprint sections.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

You might have come across a situation when you have Exchange 2013 server in two different sites (Production and DR). After adding the Database copy in ECP console it displays Database copy status unknown for the DR exchange server. Issue is strange…
OfficeMate Freezes on login or does not load after login credentials are input.
This tutorial will walk an individual through setting the global and backup job media overwrite and protection periods in Backup Exec 2012. Log onto the Backup Exec Central Administration Server. Examine the services. If all or most of them are stop…
There are cases when e.g. an IT administrator wants to have full access and view into selected mailboxes on Exchange server, directly from his own email account in Outlook or Outlook Web Access. This proves useful when for example administrator want…

704 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question