Clients keep sending DHCPDECLINE

moffe at moffe at
Sun Aug 22 19:33:30 UTC 2010

  Hi Marc

Thank you for the suggestion. I am currently dumping arp traffic (of 
course, now the problem does not show up!)

I am unable to dump as:

1) It seems random which clients are affected,
2) I currently have no equipment at hand to dump

It is a residential network, so people set up a multitude of equipment, 
brands, models, configurations etc. so the problem might come from 
almost anywhere. I am not aware that any proxy-arp equipment is 
installed, but of course someone might have installed just about 
anything. Rogue DHCP-servers happens often, but I am mostly on top of 
these (one sending NAKs but not OFFERs would be unusual).

I will try to get my hands on a two-NIC computer able to run tcpdump to 
place between an affected computer and the network.

If anyone else should have other suggestions in the meantime, I would be 
very happy.

Best regards and thank you

Den 20-08-2010 15:57, Marc Perea skrev:
> Hi Rasmus,
> this problem can have a few different causes, but I remember having a 
> similar issue when we had Vista attached to a Cisco relay agent on a 
> router. After specific positioning of a packet capture to identify the 
> behavior, Vista sends a gratuitous arp after the ACK as one final 
> check to see if anyone else on the network has that IP before binding 
> it to its interface for use. Unfortunately for us, our Cisco router 
> was answering that arp with its own MAC, presumably identifying that 
> the Cisco could get to that IP so it responded to the arp by proxy. We 
> did a no ip proxy-arp on that interface and our router stopped 
> responding to the g-arps, and things were quiet (and working).
> Not sure if this is the case for you or not, but I'd at least get a 
> sniff going just north of the client to see what situation is 
> occurring that causes the client to DECLINE - delayed NAK perhaps from 
> another piece of gear?
> HTH -- Marc
> >Over the last months I have suddenly seen a behaviour, that is new to
> >me:
> >
> >1) Client DHCPDISCOVERs
> >2) Server DHCPOFFERs
> >3) Client DHCPREQUESTs
> >4) Server DHCPACKs
> >5) Client DHCPDECLINEs
> >6) Server abandons IP
> >7) Goto 1, with new IP
> _______________________________________________
> dhcp-users mailing list
> dhcp-users at

Rasmus Bøg Hansen ||
moffe at      ||

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the dhcp-users mailing list