+ Post New Thread
Page 1 of 2 12 LastLast
Results 1 to 15 of 16
Wireless Networks Thread, DHCP Traffic flooding network in Technical; Hi, We have just finished networking a few buildings. All rooms in the buildings connect to a HP Procurve 2510G-24 ...
  1. #1
    Out_of_Sync's Avatar
    Join Date
    Aug 2008
    Location
    Windhoek
    Posts
    51
    Thank Post
    14
    Thanked 2 Times in 2 Posts
    Rep Power
    13

    Angry DHCP Traffic flooding network

    Hi,

    We have just finished networking a few buildings.

    All rooms in the buildings connect to a HP Procurve 2510G-24 with CAT6.
    From the HP Procurve they connect the the main HP Procurve switch via fiber.

    All the machine are XP SP3 and have static network configs. As soon as I connect the switches from the buildings , the network gets flooded by DHCP data triaffic. Which I was able to get from the proxy server, all connection on ports 67 and 68.

    This slows down the complete network, so that none of the computer in the labs can log on to the server. On the my graphs I can see the traffic on that interface going up to 6-7 MB/s

    I have a Windows 2008 R2 server and Windows 2003 SP2, the 2k3 server is the PDC.

    Any ideas ?

  2. #2

    Join Date
    Aug 2005
    Location
    London
    Posts
    3,157
    Thank Post
    116
    Thanked 529 Times in 452 Posts
    Blog Entries
    2
    Rep Power
    124
    I've seen this before when you've linked two switch ports - not sure why DHCP traffic seems to predominate rather than anything else.

    Given that you've just been installing new stuff, is it possible that you've somehow patched wrongly???

  3. #3

    teejay's Avatar
    Join Date
    Apr 2008
    Posts
    3,213
    Thank Post
    286
    Thanked 778 Times in 588 Posts
    Rep Power
    338
    Looks like you've got a loopback somewhere, try enabling spanning tree protocol on your switches.

  4. #4

    RabbieBurns's Avatar
    Join Date
    Apr 2008
    Location
    Sydney
    Posts
    5,531
    Thank Post
    1,341
    Thanked 470 Times in 307 Posts
    Blog Entries
    6
    Rep Power
    200
    we had an issue with a dodgy network printer that caused a dhcp flood that took down our entire network. It was DHCP Requesting an IP address, and it was being issued one, but it wasnt acknwledging, and kept on asking..

    Wireshark identified this printer pretty simply and let us locate and unplug it..

    Have you tried wierehsark to see if theres anything going on?

  5. #5
    bio
    bio is offline
    bio's Avatar
    Join Date
    Apr 2008
    Location
    netherlands
    Posts
    520
    Thank Post
    16
    Thanked 130 Times in 102 Posts
    Rep Power
    38
    hook up a laptop with wireshark and try to lockdown that dodgy device thats flooding your network.

    bio...

  6. #6
    p858snake's Avatar
    Join Date
    Dec 2008
    Location
    Queensland
    Posts
    1,490
    Thank Post
    37
    Thanked 175 Times in 151 Posts
    Blog Entries
    2
    Rep Power
    51
    Well what else do you have on your network apart from the workstations since you mentioned they were static assigned?

  7. #7

    Join Date
    Oct 2008
    Location
    Leeds
    Posts
    225
    Thank Post
    21
    Thanked 17 Times in 17 Posts
    Rep Power
    15
    I would start by looking for a "loop back" somewhere (where a network cable goes out of one port on the switch and back into another).

    One reason why you're seeing DHCP (presumably client request) floods might be that it will be one of the first broadcast protocols to initiate on a network (first thing when the device is turned on), so if there is a loopback somewhere this is the one which will get amplified by it and show up on wireshark.

    Having eliminated this, I would then look for a faulty device as a secondary option.

  8. #8
    cpjitservices's Avatar
    Join Date
    Jul 2010
    Location
    Hessle
    Posts
    2,540
    Thank Post
    524
    Thanked 294 Times in 270 Posts
    Rep Power
    84
    I would look at wireshark to make sure rthere isnt some sort of server trying to dole out IP's to clients that allready have them, check for Server IP's in Wireshark and look at whats beeing sent from those IP's to see whtehrt it's DHCP or not - you may just need to restart the server or the service.

  9. #9
    Out_of_Sync's Avatar
    Join Date
    Aug 2008
    Location
    Windhoek
    Posts
    51
    Thank Post
    14
    Thanked 2 Times in 2 Posts
    Rep Power
    13
    Thanks for the replies.

    I did have a loop back problem when I added the patch leads, might have over looked one. I will also give Wireshark a try.

  10. #10
    Out_of_Sync's Avatar
    Join Date
    Aug 2008
    Location
    Windhoek
    Posts
    51
    Thank Post
    14
    Thanked 2 Times in 2 Posts
    Rep Power
    13
    Quote Originally Posted by p858snake View Post
    Well what else do you have on your network apart from the workstations since you mentioned they were static assigned?
    Well I do have one Samsung and two HP printers.

  11. #11

    Join Date
    Jun 2008
    Posts
    731
    Thank Post
    118
    Thanked 66 Times in 54 Posts
    Rep Power
    31
    What HP Printers do you have? The reason I ask is because I had the 2600n's flooding the network once when their NICs went kaput. It's probably worthwhile checking this out just so you can eliminate it as a possibility.

  12. #12

    RabbieBurns's Avatar
    Join Date
    Apr 2008
    Location
    Sydney
    Posts
    5,531
    Thank Post
    1,341
    Thanked 470 Times in 307 Posts
    Blog Entries
    6
    Rep Power
    200
    Quote Originally Posted by Chuckster View Post
    What HP Printers do you have? The reason I ask is because I had the 2600n's flooding the network once when their NICs went kaput. It's probably worthwhile checking this out just so you can eliminate it as a possibility.
    they were the exact model that caused the issue we had I mentioned above

  13. #13

    Join Date
    Jun 2008
    Posts
    731
    Thank Post
    118
    Thanked 66 Times in 54 Posts
    Rep Power
    31
    Oops, my bad. Trust me to skim read things too quickly without absorbing the main bits.

  14. #14
    Out_of_Sync's Avatar
    Join Date
    Aug 2008
    Location
    Windhoek
    Posts
    51
    Thank Post
    14
    Thanked 2 Times in 2 Posts
    Rep Power
    13
    Ok so have now plugged in a notebook with wireshark, captured the data... Now sifting through it all trying to make sense of what is what.

    And I did find a loop back. Corrected that and ran wireshark again to check. Seems to be normal traffic only.
    Last edited by Out_of_Sync; 2nd August 2010 at 12:50 PM. Reason: update

  15. #15

    RabbieBurns's Avatar
    Join Date
    Apr 2008
    Location
    Sydney
    Posts
    5,531
    Thank Post
    1,341
    Thanked 470 Times in 307 Posts
    Blog Entries
    6
    Rep Power
    200
    Quote Originally Posted by Chuckster View Post
    Oops, my bad. Trust me to skim read things too quickly without absorbing the main bits.
    Was just commenting its strange the same printer caused that exact same issue elsewhere .

SHARE:
+ Post New Thread
Page 1 of 2 12 LastLast

Similar Threads

  1. Seperating Network Traffic
    By Mr.Ben in forum How do you do....it?
    Replies: 2
    Last Post: 12th November 2009, 11:39 AM
  2. Network traffic reports
    By CraigM in forum Wireless Networks
    Replies: 11
    Last Post: 15th March 2008, 12:09 AM
  3. DHCP lease duration +increased traffic
    By Kyle in forum Windows
    Replies: 6
    Last Post: 25th January 2007, 09:20 AM
  4. Sanako Study 100 flooding network
    By ranj in forum Wireless Networks
    Replies: 11
    Last Post: 24th February 2006, 11:54 AM
  5. Analyse Network Traffic
    By SpuffMonkey in forum How do you do....it?
    Replies: 10
    Last Post: 15th January 2006, 06:18 PM

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •