This is our old Q&A Site. Please post any new questions and answers at

hi All;

we have an issue last 2 days, Machines on networks get Ip adress but could not access to domaine. When checkd the DHCP server, we found out a list of BAD_ADRESS, even if those ip is not assigned. we Checked out the network if for other DHCP servers using wireshark ( Bootp == 2 Filetr), we found that all ip offers are from the principal DHCP Server. now we don't really know what is the problem??

is there any way to analyse the ARP or DNS server using Wireshark?


asked 28 Mar '13, 02:26

mysystem's gravatar image

accept rate: 0%

From what I understand ( and I had to Google for it), "BAD_ADDRESS" is what is written in Windows 2008 DHCP Server logs when it goes to allocate an IP address, but finds that a host is already using it (the DHCP server does a ARP or ICMP test) and logs this event. This forum entry gave me the clue

While you may not find a rogue DHCP server, you should be able to determine who is using that IP address. From any host you can try to ping the conflicting address, and even if you don't get a result, you should get an ARP response. From Windows you can this with "arp -a". Once you have a MAC address then it is up to you work out from your network switch mac-address tables and so forth to track down the port. Good luck!

permanent link

answered 28 Mar '13, 04:49

martyvis's gravatar image

accept rate: 7%

Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here



Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text]( "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:


question asked: 28 Mar '13, 02:26

question was seen: 5,254 times

last updated: 28 Mar '13, 04:49

p​o​w​e​r​e​d by O​S​Q​A