Clients keep sending DHCPDECLINE

moffe at moffe at
Sun Aug 22 20:06:09 UTC 2010

  Hi all

I forgot one more thing:

I am of the impression (I have got error reports from only two people 
even though I can see in the logs that it happens to many people) that 
it happens only on Windows vista (and possibly 7) only when waking up 
from hibernation.

Best regards

Den 22-08-2010 21:33, moffe at skrev:
> Hi Marc
> Thank you for the suggestion. I am currently dumping arp traffic (of 
> course, now the problem does not show up!)
> I am unable to dump as:
> 1) It seems random which clients are affected,
> 2) I currently have no equipment at hand to dump
> It is a residential network, so people set up a multitude of 
> equipment, brands, models, configurations etc. so the problem might 
> come from almost anywhere. I am not aware that any proxy-arp equipment 
> is installed, but of course someone might have installed just about 
> anything. Rogue DHCP-servers happens often, but I am mostly on top of 
> these (one sending NAKs but not OFFERs would be unusual).
> I will try to get my hands on a two-NIC computer able to run tcpdump 
> to place between an affected computer and the network.
> If anyone else should have other suggestions in the meantime, I would 
> be very happy.
> Best regards and thank you
> /Rasmus
> Den 20-08-2010 15:57, Marc Perea skrev:
>> Hi Rasmus,
>> this problem can have a few different causes, but I remember having a 
>> similar issue when we had Vista attached to a Cisco relay agent on a 
>> router. After specific positioning of a packet capture to identify 
>> the behavior, Vista sends a gratuitous arp after the ACK as one final 
>> check to see if anyone else on the network has that IP before binding 
>> it to its interface for use. Unfortunately for us, our Cisco router 
>> was answering that arp with its own MAC, presumably identifying that 
>> the Cisco could get to that IP so it responded to the arp by proxy. 
>> We did a no ip proxy-arp on that interface and our router stopped 
>> responding to the g-arps, and things were quiet (and working).
>> Not sure if this is the case for you or not, but I'd at least get a 
>> sniff going just north of the client to see what situation is 
>> occurring that causes the client to DECLINE - delayed NAK perhaps 
>> from another piece of gear?
>> HTH -- Marc
>> >Over the last months I have suddenly seen a behaviour, that is new to
>> >me:
>> >
>> >1) Client DHCPDISCOVERs
>> >2) Server DHCPOFFERs
>> >3) Client DHCPREQUESTs
>> >4) Server DHCPACKs
>> >5) Client DHCPDECLINEs
>> >6) Server abandons IP
>> >7) Goto 1, with new IP
>> _______________________________________________
>> dhcp-users mailing list
>> dhcp-users at
> -- 
> Rasmus Bøg Hansen ||
> moffe at       ||
> _______________________________________________
> dhcp-users mailing list
> dhcp-users at

Rasmus Bøg Hansen ||
moffe at      ||

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <>

More information about the dhcp-users mailing list