DHCP Traffic flooding network

[Out_of_Sync]

Hi,

 

We have just finished networking a few buildings.

 

All rooms in the buildings connect to a HP Procurve 2510G-24 with CAT6.

From the HP Procurve they connect the the main HP Procurve switch via fiber.

 

All the machine are XP SP3 and have static network configs. As soon as I connect the switches from the buildings , the network gets flooded by DHCP data triaffic. Which I was able to get from the proxy server, all connection on ports 67 and 68.

 

This slows down the complete network, so that none of the computer in the labs can log on to the server. On the my graphs I can see the traffic on that interface going up to 6-7 MB/s

 

I have a Windows 2008 R2 server and Windows 2003 SP2, the 2k3 server is the PDC.

 

Any ideas ?

[srochford]

I've seen this before when you've linked two switch ports - not sure why DHCP traffic seems to predominate rather than anything else.

 

Given that you've just been installing new stuff, is it possible that you've somehow patched wrongly???

[teejay]

Looks like you've got a loopback somewhere, try enabling spanning tree protocol on your switches.

[RabbieBurns]

we had an issue with a dodgy network printer that caused a dhcp flood that took down our entire network. It was DHCP Requesting an IP address, and it was being issued one, but it wasnt acknwledging, and kept on asking..

 

Wireshark identified this printer pretty simply and let us locate and unplug it..

 

Have you tried wierehsark to see if theres anything going on?

[bio]

hook up a laptop with wireshark and try to lockdown that dodgy device thats flooding your network.

 

bio...

[p858snake]

Well what else do you have on your network apart from the workstations since you mentioned they were static assigned?

[Bruce123]

I would start by looking for a "loop back" somewhere (where a network cable goes out of one port on the switch and back into another).

 

One reason why you're seeing DHCP (presumably client request) floods might be that it will be one of the first broadcast protocols to initiate on a network (first thing when the device is turned on), so if there is a loopback somewhere this is the one which will get amplified by it and show up on wireshark.

 

Having eliminated this, I would then look for a faulty device as a secondary option.

[cpjitservices]

I would look at wireshark to make sure rthere isnt some sort of server trying to dole out IP's to clients that allready have them, check for Server IP's in Wireshark and look at whats beeing sent from those IP's to see whtehrt it's DHCP or not - you may just need to restart the server or the service.

[Out_of_Sync]

Thanks for the replies.

 

I did have a loop back problem when I added the patch leads, might have over looked one. I will also give Wireshark a try.

[Out_of_Sync]

Well what else do you have on your network apart from the workstations since you mentioned they were static assigned?

 

Well I do have one Samsung and two HP printers.

[Chuckster]

What HP Printers do you have? The reason I ask is because I had the 2600n's flooding the network once when their NICs went kaput. It's probably worthwhile checking this out just so you can eliminate it as a possibility.

[RabbieBurns]

What HP Printers do you have? The reason I ask is because I had the 2600n's flooding the network once when their NICs went kaput. It's probably worthwhile checking this out just so you can eliminate it as a possibility.

 

they were the exact model that caused the issue we had I mentioned above

[Chuckster]

Oops, my bad. Trust me to skim read things too quickly without absorbing the main bits.

[Out_of_Sync]

Ok so have now plugged in a notebook with wireshark, captured the data... Now sifting through it all trying to make sense of what is what.

 

And I did find a loop back. Corrected that and ran wireshark again to check. Seems to be normal traffic only.

Edited August 2, 2010 by Out_of_Sync
update

[RabbieBurns]

Oops, my bad. Trust me to skim read things too quickly without absorbing the main bits.

 

Was just commenting its strange the same printer caused that exact same issue elsewhere .

[Out_of_Sync]

What HP Printers do you have? The reason I ask is because I had the 2600n's flooding the network once when their NICs went kaput. It's probably worthwhile checking this out just so you can eliminate it as a possibility.

 

I have one HP 1340n and HP CP2025N