Server 2016 DHCP filling with BAD_ADDRESS

Got a Domain Controller that provides DHCP.  Suddenly about 48 hours ago, a few users reported they couldn't get online or access the server.
Investigation found that the DHCP range is getting filled with BAD_ADDRESS, and I cannot find why.  As far as I can tell no new devices have been added to the network.  Some devices do manage to successfully get a DHCP lease, while others it just cannot get connected.

The logs do not seem to help either, here is a sample:

10,02/22/18,05:50:39,Assign,192.168.0.69,ADMINWS02.eps.local,7C050787CE52,,1624443270,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0
11,02/22/18,05:50:39,Renew,192.168.0.69,ADMINWS02.eps.local,7C050787CE52,,1624443270,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0
11,02/22/18,05:50:39,Renew,192.168.0.69,ADMINWS02.eps.local,7C050787CE52,,1624443270,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0
13,02/22/18,05:50:44,Conflict,192.168.0.69,BAD_ADDRESS,,,0,6,,,,,,,,,0
10,02/22/18,05:50:54,Assign,192.168.0.27,ADMINWS02.eps.local,7C050787CE52,,4154601187,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0
11,02/22/18,05:50:54,Renew,192.168.0.27,ADMINWS02.eps.local,7C050787CE52,,4154601187,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0
11,02/22/18,05:50:54,Renew,192.168.0.27,ADMINWS02.eps.local,7C050787CE52,,4154601187,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0
13,02/22/18,05:50:58,Conflict,192.168.0.27,BAD_ADDRESS,,,0,6,,,,,,,,,0
10,02/22/18,05:51:09,Assign,192.168.0.28,ADMINWS02.eps.local,7C050787CE52,,1468120431,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0
11,02/22/18,05:51:09,Renew,192.168.0.28,ADMINWS02.eps.local,7C050787CE52,,1468120431,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0
11,02/22/18,05:51:09,Renew,192.168.0.28,ADMINWS02.eps.local,7C050787CE52,,1468120431,0,,,,0x4D53465420352E30,MSFT 5.0,,,,0
13,02/22/18,05:51:13,Conflict,192.168.0.28,BAD_ADDRESS,,,0,6,,,,,,,,,0

It will keep repeating until addresses are full.

I cannot seem to find any common MAC address or any rogue device onsite.  Last night I disabled wifi, and this morning it filled up again.  DHCP is off on the Sonicwall onsite, so I don't see that being the problem.  

Another strange thing I found is that when we try to set a static IP right in the adapter settings of the computer, it doesn't take effect.  

Any direction would be much appreciated.
Peter VogelaarAsked:
Who is Participating?

[Product update] Infrastructure Analysis Tool is now available with Business Accounts.Learn More

x
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Jose Gabriel Ortega CastroCEOCommented:
1st. Check if the address is already given (or fixed on a computer), try to ping it.
2nd check event viewer.
3rd Use a sniffer to find out whats going on (using ipconfig /release     ipconfig /renew)

I think that you have 2 options, 1st reset the device and try again, and discard ports and nics.

jose
0
Shaun VermaakTechnical Specialist IVCommented:
Enable conflict detection with this PowerShell. Most of the times I see BAD_ADRESS it is because of static addresses in range
Set-DhcpServerSetting -ConflictDetectionAttemps 2

Open in new window


Delete the existing ones with this PowerShell
$DHCPBadReservations = Get-DhcpServerv4Scope -ComputerName $DHCPServer | Get-DhcpServerv4Lease -ComputerName $DHCPServer | Where-Object -FilterScript {$_.HostName -eq 'BAD_ADDRESS'}
$DHCPBadReservations | Remove-DhcpServerv4Reservation -ComputerName $DHCPServer

Open in new window

1
Peter VogelaarAuthor Commented:
I have conflict detection turned on, and removed all BAD_ADDRESS entries, same problem.
Before the BAD_ADDRESS gets filled up, I did scan to see if I can find anything that might be taking up that address, but nothing is found.  
When I renew on the computer, it provides an error saying that the DHCP server provided a duplicate address.  

There are currently no reservations.  

Could there be a hardware or networking fault I can look for?
0
Protecting & Securing Your Critical Data

Considering 93 percent of companies file for bankruptcy within 12 months of a disaster that blocked access to their data for 10 days or more, planning for the worst is just smart business. Learn how Acronis Backup integrates security at every stage

MaheshArchitectCommented:
most probable reason is you might have another dhcp server in network, can you check your virtual servers if any are running any dhcp service or for that matter check if VMware workstation is installed which is preconfigured with DHCP service and its not leasing out IPs
0
Shaun VermaakTechnical Specialist IVCommented:
Do ADMINWS02 etc. have two NICs?
0
Peter VogelaarAuthor Commented:
I can't seem to find another DHCP server onsite. A switch was replaced a few days ago, but that seems to be it.

Some of the computer have a second NIC installed, a wireless adapter. But non are connected.
0
Shaun VermaakTechnical Specialist IVCommented:
If conflict detection is enabled, a second DHCP server will have no effect
0
Peter VogelaarAuthor Commented:
I just ran a netscan on the network, and it seems to find a huge amount of devices.  But one or two seem to be repeated quite a few times.  They are ubiquiti devices.  I can get to the web interface of them, they are running airOS.  But since the last IT person refused to give passwords, I do not have access to log in.  Could these devices be causing the problem?
0
Peter VogelaarAuthor Commented:
After searching onsite today, we found that some wirless ptp equipment were causing a loop on the network.  Disabling them fixed our BAD_ADDRESS issue.
0

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
Peter VogelaarAuthor Commented:
Found the issue without the assistance of other people.
0
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
Windows Server 2016

From novice to tech pro — start learning today.