bad_address filling up dhcp leases

[jjohnsoncantell]

Greetings,

 

Having a weird issue thats just started in the last week. For no reason at all the dhcp leases suddenly fill up with bad addresses until the scope is full and noone can log on. The network grinds to a halt at the same time. Nothing has been changed on the dhcp side of things but a few months ago i had enabled dns scavenging, however this problem has only happened twice in the last week. It seems to happen at the time the clients renew their leases which would explain why there is a sudden flood of bad addresses but i cant think of anything that would be causing this to happen.

 

Any ideas, advice are most welcomed!

 

James

[jjohnsoncantell]

Additional info: The mac addresses being reported for all of the bad_address clients are not correct either, they are only 8 digits long as opposed to the normal 12. digits

[Mcshammer_dj]

sounds like a failed network card may be trying to get an address and then failing an retrying

 

Run wireshark and see if that can help identify the culprit

[glennda]

You don't have 2 dhcp servers do you that are conflicting?

 

Also I've seen it before where a device (printer) was requesting DHCP address but never actually taking them - therefore eating all the free addresses.

[jjohnsoncantell]

Thanks for such a quick replies. Ive heard of wireshark but never used it, what am i looking for? I have just cleared them and within seconds they are all back again. The mac addresses are still unique and i find it hard to believe that many different machines have failed all at the same time (although i cant rule it out either)

[Mcshammer_dj]

check there isn't a router or a device that can dish out ip addresses attached to the network.

[Mcshammer_dj]

Client computers running Windows Server 2003, Windows XP, Windows 2000, Windows NT 4.0, Windows Millennium Edition, and Windows 98 automatically check to determine if an IP address is already in use before using it.

 

After the DHCP client receives a lease from the DHCP server, the client sends an Address Resolution Protocol (ARP) request to the address that it has been assigned. If a reply to the ARP request is received, the client has detected a conflict and sends a DHCPDecline message to the DHCP server. The DHCP server attaches a BAD_ADDRESS value to the IP address in the scope for the length of the lease. The client then begins the lease process again, and is offered the next available address in the scope.

 

Likely an overlapping scope on another DHCP server (maybe authorised or rogue) or a PC with static IP that conflicts.

[glennda]

Or somebody has been really clever and bought in there own wireless router which happens to also be giving out addresses!

[Mcshammer_dj]

Or somebody has been really clever and bought in there own wireless router which happens to also be giving out addresses!

 

yeah seen this before with someone having a spare router so plugged it in to make hs mobile phone work wirelessly at work:doh:

[glennda]

yeah seen this before with someone having a spare router so plugged it in to make hs mobile phone work wirelessly at work:doh:

 

Same here!

[jjohnsoncantell]

could a network bridge a staff member set up on their laptop be causing this to happen??

 

James

[glennda]

could a network bridge a staff member set up on their laptop be causing this to happen??

 

James

 

Possibly - it depends what is bridged and the options setup.

[jjohnsoncantell]

it was the lan + wan nic that had been bridged. The nic was plugged in and active and the wireless card was also live and connected to the network.

[jjohnsoncantell]

havent had and bad addresses so far today but im still a bit anxious it will happen again bearing in mind its not regular since it happened on Monday and Wednesday. Got fingers crossed and thanks to all for your suggestions.

[Geoff]

Bear in mind this can also be caused deliberately by someone doing nefarious things.

 

Hak5 - Episode 702 – DHCP Exhaustion and DNS Man-in-the-Middle

Metasploit DHCP Exhaustion and DNS MiTM - DigiNinja

 

This can (along with the other issues like rogue DHCP servers) and should be mitigated by using the DHCP snooping features on your switches.

 

DHCP snooping - Wikipedia, the free encyclopedia

Edited May 31, 2012 by Geoff

[Michael]

Greetings,

 

Having a weird issue thats just started in the last week. For no reason at all the dhcp leases suddenly fill up with bad addresses until the scope is full and noone can log on. The network grinds to a halt at the same time. Nothing has been changed on the dhcp side of things but a few months ago i had enabled dns scavenging, however this problem has only happened twice in the last week. It seems to happen at the time the clients renew their leases which would explain why there is a sudden flood of bad addresses but i cant think of anything that would be causing this to happen.

 

Any ideas, advice are most welcomed!

 

James

 

If you logon locally to a workstation with a bad address, what address (if any) has it been allocated with? 169.x.x.x or something else? Generally speaking it's obvious whether or not a rogue router is the problem, as the IP might be a class C, whereas your network may be a class A for example.

 

Do you have more than one official DHCP Server in your domain? If yes, try reducing this to a single DHCP Server instance, or increase conflict detection to 2.

[Duke5A]

Generally speaking it's obvious whether or not a rogue router is the problem, as the IP might be a class C, whereas your network may be a class A for example.

 

I had this happen once when a teacher brought in a Linksys home router for wireless in their classroom. The teacher wound up plugging the LAN side into our building network and it was handing out class C's when our addressing is all class A. If this is your problem you can find it without too much pain by doing this:

 

1. View the ARP cache on the client machine with the bad address and copy the MAC of the default gateway. This is the MAC address of the rogue router.
   
2. Console into your core switch and view the MAC table looking for the MAC you just wrote down. From here you can see what physical port it learned of the MAC from.
   
3. View CDP neighbors to see which physical device is connected to that port and then telnet into that device and continue the search. Eventually you come to the last switch inline that has said rogue device jack into it.
   
4. You should now be able to go to the closet, trace back the patch from the switch port to the patch panel and figure out the physical location.
   

 

This was done on Cisco hardware, but the principal should apply to other vendor's hardware.

[jjohnsoncantell]

i havent as yet gone to a workstation with a bad address since it was happening on so many pcs at once i had to keep the rest of the clients going. I have only one dhcp server so will look into that. Duke thats a great idea, if what i have done so far doesnt work this will be the next course of action i take.

[jjohnsoncantell]

Still no bad addresses since i disabled that routing bridge... Im hoping thats problem solved. Thankyou to everyone who replied, you were most helpful.

[ricki]

Hi

 

What I would do is capture the network traffic on your dhcp server with something like wireshark for about 10 mins and then import the file into capsa free edition and it will analyse the file for you.

 

If you can get the mac of the item you might be able to find what sort of nic it is.

 

Do you have dynamic updates on the dns set to secure.

 

Also do you have conflict detection set above 0 in dhcp. This pings the ip to see if the ip is being used before issuing it.

 

You could reduce the lease time in dhcp but you need to find the problem and capsa should help.

 

If this does not find it look at dns poisoning DNS spoofing - Wikipedia, the free encyclopedia

 

Plus is there another dhcp server on another machine. May be on a laptop.

 

Richard

 

Richard