Multiple BAD_ADDRESS in DHCP showed up again

What is the reason for multiple BAD_ADDRESS in DHCP?  Description - This address is already in use.  I deleted them already few days back.  They came back for some reason.  About eight of them.
And it seems they show up after a an abrupt power outage we had.  Not sure if related.

Server 2016 Domain Controller.
LVL 17
Who is Participating?
I wear a lot of hats...

"The solutions and answers provided on Experts Exchange have been extremely helpful to me over the last few years. I wear a lot of hats - Developer, Database Administrator, Help Desk, etc., so I know a lot of things but not a lot about one thing. Experts Exchange gives me answers from people who do know a lot about one thing, in a easy to use platform." -Todd S.

Cliff GaliherCommented:
The most common cause is a rogue DHCP server. Or a DHCP scope with addresses that have also been statically assigned. The DHCP server attempts to assign them to a requesting device and the result is a conflict, and thus a bad address designation.

Experts Exchange Solution brought to you by

Your issues matter to us.

Facing a tech roadblock? Get the help and guidance you need from experienced professionals who care. Ask your question anytime, anywhere, with no hassle.

Start your 7-day free trial
DrDave242Senior Support EngineerCommented:
They came back for some reason.  About eight of them.

Are those addresses all in sequence, or are they random?
Tiras25Author Commented:
Thanks Cliff.  I guess I need to find those devices.  Let me think how...

Somewhat in sequence but not really.  
Ensure Business Longevity with As-A-Service

Using the as-a-service approach for your business model allows you to grow your revenue stream with new practice areas, without forcing you to part ways with existing clients just because they don’t fit the mold of your new service offerings.

DrDave242Senior Support EngineerCommented:
If you ping those addresses, do you get a response?

Note that a lack of a response on a given address doesn't necessarily mean that address isn't in use, as there could be a device there with a firewall that blocks ICMP traffic. If you do get a response, though, the address is unquestionably in use by something.
Tiras25Author Commented:
Yes, they are all pingable.  3 of them I can even resolve a hostname with ping -a ipdaddress
JohnBusiness Consultant (Owner)Commented:
Get Advanced IP Scanner (Famatech - Free) and run it. It should give you information about the devices. It does for me.
Tiras25Author Commented:
I'll try thanks John!
Shaun VermaakTechnical SpecialistCommented:
Enable conflict detection with this PowerShell. Most of the times I see BAD_ADRESS it is because of static addresses in a range
Set-DhcpServerSetting -ConflictDetectionAttemps 2

Open in new window

Delete the existing ones with this PowerShell
$DHCPBadReservations = Get-DhcpServerv4Scope -ComputerName $DHCPServer | Get-DhcpServerv4Lease -ComputerName $DHCPServer | Where-Object -FilterScript {$_.HostName -eq 'BAD_ADDRESS'}
$DHCPBadReservations | Remove-DhcpServerv4Reservation -ComputerName $DHCPServer

Open in new window

Owen RubinConsultantCommented:
Is it possible some of the machines in your network have set themselves to static addresses?

If the DHCP server is not aware of those (ie, reserved IP to the MAC address of those machines) then it will give out those IP addresses not knowing that someone has use that same address manually.

You could power down all machines, and bring them up one at a time WITHOUT the DHCP server running, and see if you can ping those addresses. If you can, then they are set manually and now you know which machine is using an address incorrectly.
arp -a  on the command line should show the matching MAC addresses to help you id the system.
Owen RubinConsultantCommented:
Serialband, will arp show multiple systems matching MAC addresses or only the first to answer?
It will show multiple MAC using the same IP.
Owen RubinConsultantCommented:
Thanks. I did not think that would work as I never used it for that. I learned something new today!  :-)
You do have to be on the same subnet to get the correct arp -a results.
Owen RubinConsultantCommented:
That much I could figure out!  :-)
JohnBusiness Consultant (Owner)Commented:
@Tiras25 - Thank you and I was happy to help.
It's more than this solution.Get answers and train to solve all your tech problems - anytime, anywhere.Try it for free Edge Out The Competitionfor your dream job with proven skills and certifications.Get started today Stand Outas the employee with proven skills.Start learning today for free Move Your Career Forwardwith certification training in the latest technologies.Start your trial today
IT Administration

From novice to tech pro — start learning today.