Clients keep sending DHCPDECLINE

moffe at zz9.dk moffe at zz9.dk
Sun Aug 22 19:33:30 UTC 2010


  Hi Marc

Thank you for the suggestion. I am currently dumping arp traffic (of 
course, now the problem does not show up!)

I am unable to dump as:

1) It seems random which clients are affected,
2) I currently have no equipment at hand to dump

It is a residential network, so people set up a multitude of equipment, 
brands, models, configurations etc. so the problem might come from 
almost anywhere. I am not aware that any proxy-arp equipment is 
installed, but of course someone might have installed just about 
anything. Rogue DHCP-servers happens often, but I am mostly on top of 
these (one sending NAKs but not OFFERs would be unusual).

I will try to get my hands on a two-NIC computer able to run tcpdump to 
place between an affected computer and the network.

If anyone else should have other suggestions in the meantime, I would be 
very happy.

Best regards and thank you
/Rasmus

Den 20-08-2010 15:57, Marc Perea skrev:
> Hi Rasmus,
> this problem can have a few different causes, but I remember having a 
> similar issue when we had Vista attached to a Cisco relay agent on a 
> router. After specific positioning of a packet capture to identify the 
> behavior, Vista sends a gratuitous arp after the ACK as one final 
> check to see if anyone else on the network has that IP before binding 
> it to its interface for use. Unfortunately for us, our Cisco router 
> was answering that arp with its own MAC, presumably identifying that 
> the Cisco could get to that IP so it responded to the arp by proxy. We 
> did a no ip proxy-arp on that interface and our router stopped 
> responding to the g-arps, and things were quiet (and working).
> Not sure if this is the case for you or not, but I'd at least get a 
> sniff going just north of the client to see what situation is 
> occurring that causes the client to DECLINE - delayed NAK perhaps from 
> another piece of gear?
> HTH -- Marc
>
> >Over the last months I have suddenly seen a behaviour, that is new to
> >me:
> >
> >1) Client DHCPDISCOVERs
> >2) Server DHCPOFFERs
> >3) Client DHCPREQUESTs
> >4) Server DHCPACKs
> >5) Client DHCPDECLINEs
> >6) Server abandons IP
> >7) Goto 1, with new IP
>
>
> _______________________________________________
> dhcp-users mailing list
> dhcp-users at lists.isc.org
> https://lists.isc.org/mailman/listinfo/dhcp-users


-- 
Rasmus Bøg Hansen || http://www.zz9.dk/
moffe at zz9.dk      ||

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/dhcp-users/attachments/20100822/7a61b017/attachment.html>


More information about the dhcp-users mailing list