Re: Warning from DHCP server

From: Lawrence Garvin (
Date: 12/22/03

  • Next message: "Re: Warning from DHCP server"
    Date: Mon, 22 Dec 2003 02:38:28 GMT

        Greetings Dieter.

        Normally a DHCPNACK message is transmitted when a client attempts to
    renew a lease on an address that is no longer available for lease.

        You've indicated that you do not use that network anywhere in the
    network. Assuming from this statement that you've never used this address
    anywhere in the network, it is possible that a rogue DHCP server issued that
    address to something, and that something is now attempting to renew the

        You should first verify that you have no unauthorized DHCP servers
    running on the network.

        Second, you'll want to locate this device attempting to renew the
    unavailable address.

        One way to do this is to set up a packet sniffer and capture the DHCP
    packet. However, this won't tell you much more than you can find with some
    basic tools available on any computer.

        Ping the address and see if you get a response. If you get
    a response, then enter 'arp -a' at a command prompt. This should list the
    MAC Address of the device at You can then use the first twelve
    characters of the MAC Address to identify the manufacturer of the device at
    that address. This may or may not help.

        There are also more advanced techniques that can be used, but since
    you've indicated that you do not understand a lot of these technical issues,
    I've refrained from adding any additional information here.

    Lawrence Garvin
    Onsite Technology Solutions
    ICQ#: 38440195
    MSN Messenger:
    Note: Remove 'nospam' from reply address!!
    "Dieter Visser" <> wrote in message
    > Hello,
    > Whenever a client in my network reboots I see a warning in the eventlog
    > about the DHCP server issuing a NACK for the adress We do
    > use that adress anywhere in the network. I don't understand this msg, I
    > don't understand the things I find in the TechNet articles.
    > Could somebody clarify  this for me.
    > Thanks in advance.
    > Dieter

  • Next message: "Re: Warning from DHCP server"