DNS/DHCP ip Conflicts

[rob101]

I hope some one can help as this is driving me nuts.

 

We had to get a new range added to our network as we ran out of addresses, this may not be the cause but we are getting ip conflicts (bad addresses) in dhcp and when doing a nslook up on the addresses, it throws back multiple machine names.

 

I went to a pc which had a ip confict and checked to see what dhcp server it was getting its address from and it was correctly set to the dhcp server. it was using the 2nd nic card set on the new range, which was inline with the ip the laptop had been given.

 

Taking a step back we had to give the dhcp server 2 nics one on each ip range.

 

when i tried to do a nslook up on the laptop for the address it had gotten the dhcp address from it couldn't find it.

 

So i have these problems

 

Ip conflicts about 10-15 on each range

 

Dns problems.

 

Any ideas? I can post more info if needed.

 

 

Rob.

[Disease]

Have you tried 'Scavenging Stale Records' on your DNS server to remove the duplicate entries in DNS?

[Kogelkopper]

A solution maybe, to throw away the leases in every scope, just to be sure, after working ours

The following day, the pc's will "ask" for a new IP address.

[rob101]

Have you tried 'Scavenging Stale Records' on your DNS server to remove the duplicate entries in DNS?

 

Done that. did not work.

[rob101]

A solution maybe, to throw away the leases in every scope, just to be sure, after working ours

The following day, the pc's will "ask" for a new IP address.

 

Tried that as well.

Thanks for the replays though.

[Kogelkopper]

Hi Rob,

 

Can you specify the actual settings in your DHCP server?

[azrael78]

A good idea to assist in your problem would be to disable (temporarily) dynamic DNS.

 

For anything that requires a FQDN - give it a manual DNS entry.

 

The reason I say disable it - simple, it sounds like you have multiple issues regarding DHCP AND DNS, if you take DNS out of the equation - it can make the problem easier to handle and repair.

 

If you can post your DHCP server settings, we can help you more.

 

It sounds though - like you added another DHCP scope without reconfiguring the subnet masks - check the DHCP logs.

 

Find a client that is troublesome - release the address and renew while looking at the log. It may well give you an idea.

 

What's your network infrastructure? We talking 1 DHCP server, no routers, no subnets?

 

Az

[rob101]

Thanks for the response guys here is the info you asked for, if i miss any thing just ask.

 

Scope 1

 

10.4.108.71 -10.4.111.200

sub net mask 255.255.252.0

 

lease time set to 16 hours

 

Dns tab

 

enable dns dynamic updates is ticked and always dynamically update dns a and ptr records is selected

 

discard a and ptr records when lease is deleted is ticked

 

dynamically update dns a and ptr records for dhcp clients that do not request updates is also ticked.

 

Advanced tab

 

dhcp only is selected

 

Scope options

 

router 10.4.11.254

dns servers 10.4.108.2, 10.4.108.5, 10.4.108.6

Domain name is added on this range

 

Scope 2

 

10.4.224.1 -10.4.231.253

255.255.248.0

 

lease time set to 16 hours

 

Dns

 

enable dns dynamic is ticked

dynamically update dns a and ptr records is selected

always dynamically update dns a and ptr records is not selected

discard a and ptr records when lease is deleted is ticked

 

Dynamically update dns a and ptr records for dhcp clients that do not request updates in not ticked.

 

Advanced

 

Dhcp only

 

Scope options

 

router 10.4.31.254

dns servers 10.4.108.2, 10.4.108.5, 10.4.108.6

no domain name

[azrael78]

Try this - see if it helps.

 

On the DHCP Server console - right click the DHCP server and go to Properties.

Go to the Advanced Tab.

Set 'Conflict Detection Attempts' to 1.

 

This means when your clients will try to renew their IP, the DHCP server will first check to see if the IP the client is asking for is already in use by someone else.

 

If it is - it will allocate the next available.

 

As I said previously, you should probably turn Dynamic DNS off for now (DHCP Server console again).

 

What strikes me as a little odd is that you have 1 subnet using 255.255.248.0 and another using 255.255.252.0.

 

These 2 subnet masks cover different ranges which may well be part of your confusion.

 

What is your TOTAL IP range? (As in, what numbers can you use)

 

Az

[maniac]

Is it not possible to move the entire domain onto the new scope - it has a lot more addresses on it than the old one. that way you wouldn't get any of these sorts of problems. As it stands at the moment with the subnets that you've selected, the two scopes won't be able to talk to each other as far as I can work out.

 

Mike.

[azrael78]

Mike: That's what I was wondering - you could simply superscope them both couldn't you? Giving them the shared subnet?

 

Az

[rob101]

The 2 ranges were the ones given to us from the swgfl, i think as im not totally understanding every thing here but would the router enable the 2 subnets to talk to each other?

 

i have changed the setting to 1 it was on 2m will see if that makes any difference.

 

The 2 sub nets not talking to each other would make sense when I tried to do a ns look up on the dhcp server the pc had got its duplicate ip from and it couldn't find it, it was on the same range though..

 

A question, if a pc went to the server for an address and the first range was all used would it then go to the 2nd range and take an address from there or would it just use one in its full range?

Edited November 3, 2009 by rob101

[Michael]

As already mentioned, I don't think those two ranges will talk. You're much better off migrating everything to your new second scope.

[rob101]

As already mentioned, I don't think those two ranges will talk. You're much better off migrating everything to your new second scope.

 

That's a crap load of work.

 

They must be talking to stuff on the other range as we have pc's with the 10.4.224 range talking to the servers that are all on the 10.4.108 range.

 

Still confused.

[Michael]

I suppose it really depends just how many devices have static IPs doesn't it? APs, printers, admin workstations, servers. Can't think of much else.

[teejay]

Try reducing your lease time down to about 8 hours, especially if you have laptops. Will take a few days to sort itself out though.

If that doesn't work, reduce lease to 1 hour, leave for a couple of days then delete all leases at the very end of the day when the machines are off.

Have you also checked that your DNS entries are clearing properly, especially your pointer records as this can casue big problems as well.

[rob101]

Ok I just checked, the router is enabling connection between the 2 ip ranges.

 

This could be a bottleneck as well?

 

The main pain would be all the switch's, but its looking more likely this is the change we will have to make.

[rob101]

Try reducing your lease time down to about 8 hours, especially if you have laptops. Will take a few days to sort itself out though.

If that doesn't work, reduce lease to 1 hour, leave for a couple of days then delete all leases at the very end of the day when the machines are off.

Have you also checked that your DNS entries are clearing properly, especially your pointer records as this can casue big problems as well.

 

The dns entries are not clearing properly we have pc/laptops coming up with the same ip.

 

Yes the problems with the bad addresses seem to mainly be the laptops.

 

What side effects would lowering the dhcp lease time down to 8 hours be and even more to 1 hour? Just more network traffic?

Edited November 3, 2009 by rob101

[azrael78]

The side effects are simply put that you'd get more broadcast traffic when the workstations ask for new IPs and such.

 

8 hours shouldn't kill anything but an hour may push it - but if you are really reluctant to rebuild your scope and such then you may have no choice.

 

As for DNS... it's possible that you don't have the correct scavenge interval set-up.

 

Your DNS record scavenging interval (ageing) should be similar to your DHCP lease times.

You also want to make the DHCP server do all the work with this - rather than assume the clients are happy to simply update/remove their own A and PTR records.

 

Inside DHCP are settings that basically treat the clients as if they are NT 4 (incapable of dynamic update registration) - which means the DHCP server will do all the work regarding DNS registration for you.

 

This may be helpful - or more trouble than it's worth. If your laptops are particularly troublesome you may have to set it and then undergo the procedure that teejay suggests.

 

If it were me - I'd drop lease times right down to an hour, turn off dynamic DNS (or set it so DHCP does the actual updates) and then completely purge the DHCP leases last thing on a friday when most clients are off - then I'd turn on conflict detection.

 

By Monday - you may get a few leases from a few clients who are left on, but conflict detection will handle anything nasty from them and the new clients should simply ask for new IPs by then.

 

But to be honest - you would be far better off merging your scopes into one larger one.

If you made a note of all static IP addressed systems (except servers) and got the MAC addresses, you could give them a reservation in DHCP. Then all you'd have to handle are the servers - which you do first as the clients would use DHCP for the most part.

 

The choice - is yours mate

 

Az

[rob101]

Thanks guys, trying out a few things have dropped the lease time to 8 hours and matches the scavenging time to 8 hours also.

 

Also told dhcp to do all the work in regards to the pointers.

 

Will post back the results.

[maniac]

I suppose it really depends just how many devices have static IPs doesn't it? APs, printers, admin workstations, servers. Can't think of much else.

 

And also how your static IPs are managed. We use DHCP to manage our static IP numbers for things like Printers, Access points and the like by making use of the reservations feature, then it's only a few minutes work and a re-start of the devices to change fixed IP addresses - dead handy!

 

If the router is enabling the two address ranges to talk, then it will create a serious bottle neck on the system. I really would look at migrating them onto one single address range it will make life so much easier for you long term.

 

Mike.