DHCPDECLINE messages question

[Dennis Dufford]

It is true that another host already using an offered IP would cause the client to DHCPDECLINE the offered IP.
However, what is strange in the logs below is that the client did two sequences of: (DHCPREQUEST that was DHCPACK'd by the server)  
Then the client did the DHCPDECLINE - all in the same second (12:46:48)
 
It wouldn't even normally be a problem, except (Murphy's law) the client had firewall rules setup for his first IP.
 
 
 
________________________________

From: dhcp-users-bounce at isc.org on behalf of Kirsten Petersen
Sent: Fri 9/29/2006 6:21 PM
To: dhcp-users at isc.org
Subject: Re: DHCPDECLINE messages question



I believe the DECLINE messages happen when there is another host on the
network already using that IP - a hard-coded host.

________________
Kirsten Petersen
Network Services * Oregon State University
http://oregonstate.edu/net * irc.oregonstate.edu #osu-is
"If you're not learning, you're not living."

On Fri, 29 Sep 2006, Dennis Dufford wrote:

> Ran into a new problem.  A client has complained that the dhcp server "changed" his IP.  When checking the log, this is what I find:
>
> Sep 18 02:13:31 hw1ns2 dhcpd: [ID 702911 local7.info] Added new forward map from AMOOREXP.hw.syniverse.com. to 172.28.41.179
>
> Sep 18 02:13:31 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPREQUEST for 172.28.41.179 from 00:11:43:42:b7:b2 (AMOOREXP) via dmfe0
>
> Sep 18 02:13:31 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPACK on 172.28.41.179 to 00:11:43:42:b7:b2 (AMOOREXP) via dmfe0
>
> Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] Added new forward map from AMOOREXP.hw.syniverse.com. to 172.28.41.179
>
> Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPREQUEST for 172.28.41.179 (172.28.198.20) from 00:11:43:42:b7:b2 (AMOOREXP) via 172.28.41.12
>
> Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPACK on 172.28.41.179 to 00:11:43:42:b7:b2 (AMOOREXP) via 172.28.41.12
>
> Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] Added new forward map from AMOOREXP.hw.syniverse.com. to 172.28.41.179
>
> Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPREQUEST for 172.28.41.179 (172.28.198.20) from 00:11:43:42:b7:b2 (AMOOREXP) via 172.28.41.11
>
> Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPACK on 172.28.41.179 to 00:11:43:42:b7:b2 (AMOOREXP) via 172.28.41.11
>
> Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.error] Abandoning IP address 172.28.41.179: declined.
>
> Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPDECLINE of 172.28.41.179 from 00:11:43:42:b7:b2 (AMOOREXP) via 172.28.41.12: not found
>
> Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.error] Abandoning IP address 172.28.41.179: declined.
>
> Sep 18 12:46:48 hw1ns2 dhcpd: [ID 702911 local7.info] DHCPDECLINE of 172.28.41.179 from 00:11:43:42:b7:b2 (AMOOREXP) via 172.28.41.11: not found
>
>
>
>
>
> In checking my logs for the last nine days, about 2,500,000 entries, I found only the above two DHCPDECLINE entries - toatal.  Does anyone have any idea why a WindowsXP box would just up and:
>
> A)  do two cycles of DHCPREQUEST & DHCPACK, and then:
>
> B)  do another DHCPREQUEST and then DHCPDECLINE the same IP?
>
>
>
>