Mac Thread, Mavericks (9.2) server 3 broadcasting IP addresses even though DHCP is turned off? in Technical; Can anyone explain this? I wasn't actually at work on the day this happened but the network manager was sending ...
22nd May 2014, 03:20 PM #1
- Rep Power
Mavericks (9.2) server 3 broadcasting IP addresses even though DHCP is turned off?
Can anyone explain this? I wasn't actually at work on the day this happened but the network manager was sending me screenshots of devices with IPs that are in our DHCP servers exclusion range so it did happen and she claims that once the server was turned off it stopped happening? I have no idea how this might be possible...
I had installed deploystudio & netboot a day prior to all of this
Had configured images etc within the server and imported them via netboot
Nothing else that I can explain, the server was fine for the whole day previously during my attendance but currently I'm being blamed for this issue when neither I or anyone else can explain how it's even possible (can't turn it back on to test for obvious reasons).
Any advise or theories are appreciated.
22nd May 2014, 03:25 PM #2
Presumably Mavericks is your DHCP Server or is it a Windows Server, or a router?
Logically I'd say you need to look at DHCP Server (wherever it's hosted) to check the distribution range is correct. I'd also check there isn't a second DHCP server distributing IPs. This is one possible explanation, although I'd also expect to see IP conflicts if that were the case too.
The other possibility is the IPs you're seeing have been set statically, although you'd expect a NM to tell whether or not that's the case.
24th May 2014, 10:01 AM #3
- Rep Power
Thanks for your reply Michael,
Originally Posted by Michael
DHCP is running on the domain controller (Windows 2008 r2)
Manager claims that the issue resolved itself when turning the Mavericks server off so the DHCP server itself is fine (I'd assume?)
Defiantly not another DHCP server on the network.
IPs were assigned by DHCP according to the manager.
I was thinking earlier, I had mavericks pointing directly to the router (bypassing our inline firewall) - would it be possible for mavericks to some how initiated the router to start acting as a DHCP and giving out IP addresses?
Still crazy confused about all this...
25th May 2014, 10:46 AM #4
Most unlikely, Mavericks or Windows cannot control your router in this fashion. If turning the Mavericks server off resolved it, I suspect the DHCP role/service was enabled.
The other possibility (depending how your network's setup), is the IPs were coming from another network.
26th May 2014, 03:25 PM #5
- Rep Power
Double & triple checked this (gotta make sure I'm not losing my mind lol) and DHCP was 100% turned off - that being said it was turned off within the server 3 app, is there anywhere else where DHCP can be turned on? (the only other things installed were Deploystudio, Netboot and Workgroup manager)
26th May 2014, 04:14 PM #6
Don't trust the server app, it is a POS and will fail or succeed silently in some cases. Best to plug the mac and a client into a separate small switch and test if it is still firing off DHCP. I had all sorts of issues with profile manager which would 'successfully' fail at initialising. Cured by a stack of reboots on the server even though there was never an error message or log I could find that explained itself.
I would test it off network as above through a bunch of reboots to make sure the problem does not re-occour and maybe look at the remote access settings on the box in case it has been compromised.
Basicly, don't trust the GUI, it lies and if someone switched it on then off again it may well have stuck in the on state. Remember these are the same people who logged passwords in plain text to the hard drive and didn't bother checking them for a week or so(10.6 I think), I would not trust their code at all. The only trustable way to know is to dig around the config.plist files and/or just a manual check against a separate test network - ie. it and a client on a switch.
I guess there are a couple of other possibilities... IP Spoofing or just defaults if your mac is setup on something like 192.168.0.1 a user brought in WAP could easily cause that havoc - check the MAC address on reoccurrence if it happened again to prove it.
Last edited by SYNACK; 26th May 2014 at 04:19 PM.
27th May 2014, 12:11 PM #7
Can you use wireshark to capture one of the packets to see if it is a DHCPOFFER message from the mavericks server and to see what information is contained in it? If it is a DHCPOFFER message then it must be sending it out from a request from a client machine wanting an IP.
By enjay in forum Windows Server 2008 R2
Last Post: 17th October 2011, 05:19 PM
By mtdmitchell in forum Mac
Last Post: 18th October 2010, 12:26 PM
By Richings110 in forum Internet Related/Filtering/Firewall
Last Post: 30th June 2010, 02:31 PM
By nicholab in forum Windows
Last Post: 12th March 2009, 05:01 PM
By tosca925 in forum Educational Software
Last Post: 11th September 2007, 07:53 PM
Users Browsing this Thread
There are currently 1 users browsing this thread. (0 members and 1 guests)