Mavericks (9.2) server 3 broadcasting IP addresses even though DHCP is turned off?

[Jamie_Evans]

Can anyone explain this? I wasn't actually at work on the day this happened but the network manager was sending me screenshots of devices with IPs that are in our DHCP servers exclusion range so it did happen and she claims that once the server was turned off it stopped happening? I have no idea how this might be possible...

 

Additional information:

I had installed deploystudio & netboot a day prior to all of this

Had configured images etc within the server and imported them via netboot

 

Nothing else that I can explain, the server was fine for the whole day previously during my attendance but currently I'm being blamed for this issue when neither I or anyone else can explain how it's even possible (can't turn it back on to test for obvious reasons).

 

Any advise or theories are appreciated.

[Michael]

Presumably Mavericks is your DHCP Server or is it a Windows Server, or a router?

 

Logically I'd say you need to look at DHCP Server (wherever it's hosted) to check the distribution range is correct. I'd also check there isn't a second DHCP server distributing IPs. This is one possible explanation, although I'd also expect to see IP conflicts if that were the case too.

 

The other possibility is the IPs you're seeing have been set statically, although you'd expect a NM to tell whether or not that's the case.

[Jamie_Evans]

Presumably Mavericks is your DHCP Server or is it a Windows Server, or a router?

 

Logically I'd say you need to look at DHCP Server (wherever it's hosted) to check the distribution range is correct. I'd also check there isn't a second DHCP server distributing IPs. This is one possible explanation, although I'd also expect to see IP conflicts if that were the case too.

 

The other possibility is the IPs you're seeing have been set statically, although you'd expect a NM to tell whether or not that's the case.

Thanks for your reply Michael,

 

DHCP is running on the domain controller (Windows 2008 r2)

Manager claims that the issue resolved itself when turning the Mavericks server off so the DHCP server itself is fine (I'd assume?)

Defiantly not another DHCP server on the network.

IPs were assigned by DHCP according to the manager.

 

I was thinking earlier, I had mavericks pointing directly to the router (bypassing our inline firewall) - would it be possible for mavericks to some how initiated the router to start acting as a DHCP and giving out IP addresses?

 

Still crazy confused about all this...

[Michael]

Most unlikely, Mavericks or Windows cannot control your router in this fashion. If turning the Mavericks server off resolved it, I suspect the DHCP role/service was enabled.

 

The other possibility (depending how your network's setup), is the IPs were coming from another network.

[Jamie_Evans]

Double & triple checked this (gotta make sure I'm not losing my mind lol) and DHCP was 100% turned off - that being said it was turned off within the server 3 app, is there anywhere else where DHCP can be turned on? (the only other things installed were Deploystudio, Netboot and Workgroup manager)

 

Thanks Michael.

[SYNACK]

Don't trust the server app, it is a POS and will fail or succeed silently in some cases. Best to plug the mac and a client into a separate small switch and test if it is still firing off DHCP. I had all sorts of issues with profile manager which would 'successfully' fail at initialising. Cured by a stack of reboots on the server even though there was never an error message or log I could find that explained itself.

 

I would test it off network as above through a bunch of reboots to make sure the problem does not re-occour and maybe look at the remote access settings on the box in case it has been compromised.

 

Basicly, don't trust the GUI, it lies and if someone switched it on then off again it may well have stuck in the on state. Remember these are the same people who logged passwords in plain text to the hard drive and didn't bother checking them for a week or so(10.6 I think), I would not trust their code at all. The only trustable way to know is to dig around the config.plist files and/or just a manual check against a separate test network - ie. it and a client on a switch.

 

I guess there are a couple of other possibilities... IP Spoofing or just defaults if your mac is setup on something like 192.168.0.1 a user brought in WAP could easily cause that havoc - check the MAC address on reoccurrence if it happened again to prove it.

Edited May 26, 2014 by SYNACK

[jonnykewell1]

Can you use wireshark to capture one of the packets to see if it is a DHCPOFFER message from the mavericks server and to see what information is contained in it? If it is a DHCPOFFER message then it must be sending it out from a request from a client machine wanting an IP.