DHCP issues - Bad Addresses

[newpersn]

Hello

 

Got a strange issue that is effecting one of out VLANS, Since Tuesday we been getting spammed with BAD Address in DCHP. 

 

We have tired removing failover between the 2 dc's and nothing has changed. Rebooted both DC's just in case its a software bug, 

 

Currently looking at Wireshark but no having much luck with trying to filter to see where its coming from.

 

Any ideas?

[PotNoodleTech]

Could someone have plugged something in to a port on that VLAN that's trying to act as a DHCP server, a wifi router a 4g router some kind of badly behaved CCTV camera etc?

[newpersn]

We haven't spotted anything plugged in, But this VLAN is byod network which is broadcasted over the wireless network

[JRA]

Could one of the WAPs have gone rogue and started handing out addresses? Might be worth a look, I'd be suspecting some sort of rogue DHCP server on it somewhere (and would be checking Wireshark as you have.)

[newpersn]

I have just changed the vLAN for our vistors SSID as it was set to the BYOD, (Not sure who set that and how long it been on it) and checked a few switches in case of any rogue. 

 

Not had any Bad address within the last 20 mins. (Fingers crossed it was a Rouge AP.)

 

 

[newpersn]

And bad_address has returned. Back to the drawing board. its also effecting our main vLAN now.

[JRA]

Pain! Could it be one of your switches doing it even? Is this on all your VLANs now or is it just ones the WAPs can bridge to?