Getting DHCP BAD_ADDRESS on Windows DHCP
-
We are looking for rogue DHCP servers now, but dont' know of where one might be hiding. We've ensure all of the network gear does not have one.
-
I wonder what your DHCP leases are set to. I just remembered a case where the lease times were set to a ridiculously high 30 days. They ran out of IPs and got a flood of BAD_ADDRESS notifications; normally the clients would just get 169.254.x.x but lower the lease timer to 8 hours resolved it.
-
@bbigford said in Getting DHCP BAD_ADDRESS on Windows DHCP:
I wonder what your DHCP leases are set to. I just remembered a case where the lease times were set to a ridiculously high 30 days. They ran out of IPs and got a flood of BAD_ADDRESS notifications; normally the clients would just get 169.254.x.x but lower the lease timer to 8 hours resolved it.
Pool has plenty available. Just checked.
-
Break out Wireshark yet?
-
@scottalanmiller said in Getting DHCP BAD_ADDRESS on Windows DHCP:
We are looking for rogue DHCP servers now, but dont' know of where one might be hiding. We've ensure all of the network gear does not have one.
turn off the DHCP you know of and see if you still have DHCP being served. That will easily tell you if you have a rouge DHCP server somewhere.
-
I bet someone plugged in a wireless router thinking "well we needed an unmanaged switch for these few devices... what's the big deal?"
-
@bbigford said in Getting DHCP BAD_ADDRESS on Windows DHCP:
Break out Wireshark yet?
yeah, but that doesn't help since the MACs are bad.
-
We just found a rogue lightbulb. Not the issue, but an interesting find.
-
@scottalanmiller said in Getting DHCP BAD_ADDRESS on Windows DHCP:
@bbigford said in Getting DHCP BAD_ADDRESS on Windows DHCP:
Break out Wireshark yet?
yeah, but that doesn't help since the MACs are bad.
I believe in Hyper-V that you can mess with MACs to where they aren't standard. Any chance this is a VM and was mistakenly set?
-
Appeared to be something in wireless. Unplugged the AP and it stopped.
-
@scottalanmiller said in Getting DHCP BAD_ADDRESS on Windows DHCP:
Appeared to be something in wireless. Unplugged the AP and it stopped.
Hah, called it!
-
Base problem now.... whatever device this is keeps trying to connect and fills up the DHCP range quickly causing issues.
-
@scottalanmiller said in Getting DHCP BAD_ADDRESS on Windows DHCP:
Base problem now.... whatever device this is keeps trying to connect and fills up the DHCP range quickly causing issues.
What is the make and model?
-
@bbigford said in Getting DHCP BAD_ADDRESS on Windows DHCP:
@scottalanmiller said in Getting DHCP BAD_ADDRESS on Windows DHCP:
Base problem now.... whatever device this is keeps trying to connect and fills up the DHCP range quickly causing issues.
What is the make and model?
Don't know.
-
I saw this once, this is far fetched but any wireless devices like clocks, iot or ip phones? We had a sapling wifi clock reacking havoc on our Network once. I also have seen this when a firewall was plugged in that had proxy arp turned on on the inside interface.
-
@scottalanmiller said in Getting DHCP BAD_ADDRESS on Windows DHCP:
Base problem now.... whatever device this is keeps trying to connect and fills up the DHCP range quickly causing issues.
That's sounds exactly like a DHCP starvation attack! Intruder alert!
-
@pete-s said in Getting DHCP BAD_ADDRESS on Windows DHCP:
@scottalanmiller said in Getting DHCP BAD_ADDRESS on Windows DHCP:
Base problem now.... whatever device this is keeps trying to connect and fills up the DHCP range quickly causing issues.
That's sounds like a DHCP starvation attack!
It ends up being that way, but we don't think it is intentional.
-
@scottalanmiller said in Getting DHCP BAD_ADDRESS on Windows DHCP:
@pete-s said in Getting DHCP BAD_ADDRESS on Windows DHCP:
@scottalanmiller said in Getting DHCP BAD_ADDRESS on Windows DHCP:
Base problem now.... whatever device this is keeps trying to connect and fills up the DHCP range quickly causing issues.
That's sounds like a DHCP starvation attack!
It ends up being that way, but we don't think it is intentional.
But what could possibly make the mac address change for each request? Or you think some hardware is broken?
-
@pete-s said in Getting DHCP BAD_ADDRESS on Windows DHCP:
@scottalanmiller said in Getting DHCP BAD_ADDRESS on Windows DHCP:
@pete-s said in Getting DHCP BAD_ADDRESS on Windows DHCP:
@scottalanmiller said in Getting DHCP BAD_ADDRESS on Windows DHCP:
Base problem now.... whatever device this is keeps trying to connect and fills up the DHCP range quickly causing issues.
That's sounds like a DHCP starvation attack!
It ends up being that way, but we don't think it is intentional.
But what could possibly make the mac address change for each request?
The MAC address is gibberish, so our guess is a broken device (either end point or AP.)
-
@scottalanmiller said in Getting DHCP BAD_ADDRESS on Windows DHCP:
@pete-s said in Getting DHCP BAD_ADDRESS on Windows DHCP:
@scottalanmiller said in Getting DHCP BAD_ADDRESS on Windows DHCP:
@pete-s said in Getting DHCP BAD_ADDRESS on Windows DHCP:
@scottalanmiller said in Getting DHCP BAD_ADDRESS on Windows DHCP:
Base problem now.... whatever device this is keeps trying to connect and fills up the DHCP range quickly causing issues.
That's sounds like a DHCP starvation attack!
It ends up being that way, but we don't think it is intentional.
But what could possibly make the mac address change for each request?
The MAC address is gibberish, so our guess is a broken device (either end point or AP.)
How fast are the requests showing up? Maybe that would determine if it's malicious or not?
