BAD_Lease from wireless devices - Scope ran out of IP

[bicky]

Dear All,

 

We have Windows DHCP server with several scopes. One particular (10.19.0.0/20) used for student BYOD devices, is frequently running out of IP and 90% are bad_address.

DHCP lease is 30 minutes. Conflict detection has been set to 2.

DHCP logs for these bad address has incomplete (8 digit) mac-address. These 8 digit mac-address are ip address reversed in hex format.

Rogue DHCP Server detection shows no other DHCP server on the network.

Wireshark packet capture on the DHCP server and on the wireless device shows no devices that is handing out the IP.

We use Ruckus vSZ and student has to go through Ruckus Cloudpath to onboard their devices. There aren't any physical network ports on the school which is untagged on this network vlan i.e. no ethernet devices are connected to this network via cable.

Beside student iOS, Android & Windows devices, no other devices are connected to this network.

 

All our network switches are HP Procurve/Aruba.

Ruckus vSZ running latest firmware.

As a test I have already tried moving that particular DHCP scope to a separate DHCP Server.

 

I am running out of ideas, any help on this would be much appreciated, thank you.

[JRA]

Have a very hazy memory of tackling something similar once. Turned out it was a staff Galaxy S# phone doing it.

 

I'd have definitely started where you were and looked on a device to see what IT thought it's DHCP server was.

 

Can you in your (newer than mine) Ruckus setup, stop devices talking to each other on any particular subnet/wireless network and only whitelist the gateway? How long has it been going on even?

 

Also YONKS ago had a strange problem that I never did get to the bottom of where I was sure a Unifi WAP or two were hogging DHCP leases in some fashion but left before we solved that one. Worth a check of the individual WAPs?

[kingoranks]

Have dealt with similar issues before. Start by blocking all phones using their mac address on your DHCP server

[bicky]

Can you in your (newer than mine) Ruckus setup, stop devices talking to each other on any particular subnet/wireless network and only whitelist the gateway? How long has it been going on even?

 

Wireless Isolation is turned on.

I noticed quite lot of BAD_Address early January, but scope running out of IP started happening since early last week.

[Davit2005]

What is the lease time on the scope, for BYOD WiFi I'd look at reducing to a day if not less if not already. That 10.19.0.0/20 does give you a huge range on that scope. For context we have 20 /22 networks for wifi and lease time of 4 hours on these scopes.

 

Have you more than one DHCP server?

Edited January 26, 2023 by Davit2005

[bicky]

What is the lease time on the scope, for BYOD WiFi I'd look at reducing to a day if not less if not already. That 10.19.0.0/20 does give you a huge range on that scope. For context we have 20 /22 networks for wifi and lease time of 4 hours on these scopes.

 

Have you more than one DHCP server?

 

Lease time = 30 minutes (changed from 24 hours when bad_address started appearing)

This is the only DHCP server.

[robintech]

Wonder if creating a reservation for the hex IP MAC would stop it from using up the scope