two hosts with the same IP

[Cuttler, Brian R (HEALTH)]

Running DHCP on Ubuntu 22.04.4 LTS

brian at cedar:/var/log$ DHCP -V
Internet Systems Consortium DHCP Server 4.4.1
Copyright 2004-2018 Internet Systems Consortium.

Noted one system in particular was having  network issues, ping to the IP was good, ping from the IP was problematic, lots of dropping pings in about 25 second groups/blocks.

Also having trouble maintaining SSH connection into the host, and host keys needed to be removed and reaccepted.

On a hunch I checked the dhcp log and found two different MAC addresses receiving the same IP.

Jul  9 11:49:38 cedar DHCP[1019]: DHCPREQUEST for 10.50.148.212 from d4:5d:64:08:91:7c via 10.50.148.1
Jul  9 11:49:38 cedar DHCP[1019]: DHCPACK on 10.50.148.212 to d4:5d:64:08:91:7c via 10.50.148.1
Jul 10 15:04:17 cedar DHCP[1019]: DHCPREQUEST for 10.50.148.212 from b0:7b:25:de:57:84 (berkeley) via 10.50.148.1
Jul 10 15:04:17 cedar DHCP[1019]: DHCPACK on 10.50.148.212 to b0:7b:25:de:57:84 (berkeley) via 10.50.148.1
Jul 10 15:05:16 cedar DHCP[1019]: DHCPDISCOVER from b0:7b:25:de:57:84 (berkeley) via 10.50.148.1
Jul 10 15:05:16 cedar DHCP[1019]: DHCPOFFER on 10.50.148.212 to b0:7b:25:de:57:84 (berkeley) via 10.50.148.1
Jul 10 15:05:16 cedar DHCP[1019]: DHCPREQUEST for 10.50.148.212 (10.50.156.21) from b0:7b:25:de:57:84 (berkeley) via 10.50.148.1
Jul 10 15:05:16 cedar DHCP[1019]: DHCPACK on 10.50.148.212 to b0:7b:25:de:57:84 (berkeley) via 10.50.148.1

I also note that one of the two hosts has a reservation.

        host Suraj {
                hardware ethernet d4:5d:64:08:91:7c;
                fixed-address 10.50.148.212;
                }

While I realize that a host with a reservation might be down, and another machine could get the IP if its in the available pool I'm very surprised by the behavior we were seeing.
If the non-received MAC received the IP wouldn't the MAC with the reservation still cause a ping test for availability to be performed?
I can't think of any other way this could have happened.

Can anyone help me to understand what actually happened and how best to prevent similar events in the future?

thanks in advance,
Brian


Brian Cuttler, System and Network Administration
Wadsworth Center, NYS Department of Health
Albany, NY 12201 POB 509
Brian.Cuttler at Health.NY.gov<mailto:Brian.Cuttler at Health.NY.gov>
518 486-1697

-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.isc.org/pipermail/dhcp-users/attachments/20240710/0ea2adf0/attachment.htm>