This is our old Q&A Site. Please post any new questions and answers at ask.wireshark.org.

Hi all,

I have a few machines now that are exhibiting this problem by where i can see the DHCP Discover -> DHCP Offer -> DHCP Request -> DHCP ACK but the client does not take the address given to it. The MAC addresses match so its not like it should not be responding. I have tried multiple cisco routers using both 12.4 and 15.0 IOS releases, I have tried 867 and 887 routers and i get the same issue. The laptop that I am using to test is plugged straight into the back of the router with nothing else plugged in.

Has anyone seen this before? Its getting REAL annoying as these are branch offices which are not local, so i cant debug them all that much, do the point where I flew out to one of them, swapped out their router so at least I can have a router back in the office that exhibits this behaviour so i can at least test it.

Older machines (without the intel 82579LM chipset) seem to work fine, so its not like its a router issue I dont think.

I'm out of ideas... can I post the capture perhaps in case there is something i am missing?

[edit] The clients are Windows 7 x64. I have just tested it on another NIC and it would appear that the intel nic is not doing a DHCP INFORM like it should? what would cause that?

asked 18 Sep '13, 20:19

pontiff's gravatar image

pontiff
11113
accept rate: 0%

edited 18 Sep '13, 20:46


If a client does not take an IP address that was assigned by a complete DHCP DORA process it usually means that the IP is already in use by another system. Right after the last DHCK ACK you should see that the client is using Gratuitous ARPs to check if the IP it was given is in use. If it receives an answer to that ARP the IP is in use, and the client will discard and never use it. Check if the client does perform this kind of test and if there is a duplicate IP address. Often someone configures a static IP that is part of the DHCP range (by mistake or ignorance), which will cause this kind of problem.

Worst case is when you have a static IP-to-MAC mapping in the DHCP server so that the client always gets the same IP but can never use it because it is already taken. In that case the DHCP process will go on forever because the client will always refuse the IP and will always get it assigned again in the next run.

DHCP inform is not mandatory; it may or may not appear.

permanent link

answered 18 Sep '13, 22:23

Jasper's gravatar image

Jasper ♦♦
23.8k551284
accept rate: 18%

Hi jasper, that's what I would have though too but I don't see it doing that, it just goes back to DHCP discover. Is there a way I can post the capture somewhere? This laptop is doing it with 2 different routers as I say so I am pretty sure it's a client issue somewhere.

No one issuing the ip. This is the very first client on the router so nothing can interfere

(18 Sep '13, 23:11) pontiff

You could post the trace at http://www.cloudshark.org and post the link here. Is it a trace taken directly at/on the client, oder somewhere else?

(19 Sep '13, 01:02) Jasper ♦♦
Your answer
toggle preview

Follow this question

By Email:

Once you sign in you will be able to subscribe for any updates here

By RSS:

Answers

Answers and Comments

Markdown Basics

  • *italic* or _italic_
  • **bold** or __bold__
  • link:[text](http://url.com/ "title")
  • image?![alt text](/path/img.jpg "title")
  • numbered list: 1. Foo 2. Bar
  • to add a line break simply add two spaces to where you would like the new line to be.
  • basic HTML tags are also supported

Question tags:

×52
×44
×43
×10
×3

question asked: 18 Sep '13, 20:19

question was seen: 6,887 times

last updated: 19 Sep '13, 01:02

p​o​w​e​r​e​d by O​S​Q​A