Re: Warning from DHCP server
From: Lawrence Garvin (lrgarvin_at_nospam.swbell.net)
Date: 12/22/03
- Previous message: Jason LaRue: "Re: File sharing security question"
- In reply to: Dieter Visser: "Warning from DHCP server"
- Next in thread: chris_at_nospam.com: "Re: Warning from DHCP server"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Date: Mon, 22 Dec 2003 02:38:28 GMT
Greetings Dieter.
Normally a DHCPNACK message is transmitted when a client attempts to
renew a lease on an address that is no longer available for lease.
You've indicated that you do not use that network anywhere in the
network. Assuming from this statement that you've never used this address
anywhere in the network, it is possible that a rogue DHCP server issued that
address to something, and that something is now attempting to renew the
address.
You should first verify that you have no unauthorized DHCP servers
running on the network.
Second, you'll want to locate this device attempting to renew the
unavailable address.
One way to do this is to set up a packet sniffer and capture the DHCP
packet. However, this won't tell you much more than you can find with some
basic tools available on any computer.
Ping the address 192.168.0.12 and see if you get a response. If you get
a response, then enter 'arp -a' at a command prompt. This should list the
MAC Address of the device at 192.168.0.12. You can then use the first twelve
characters of the MAC Address to identify the manufacturer of the device at
that address. This may or may not help.
There are also more advanced techniques that can be used, but since
you've indicated that you do not understand a lot of these technical issues,
I've refrained from adding any additional information here.
-- _________________________________________ Lawrence Garvin Principal/CEO Onsite Technology Solutions http://www.onsitechsolutions.com ICQ#: 38440195 MSN Messenger: onsite@nospam.eforest.net Note: Remove 'nospam' from reply address!! _________________________________________ "Dieter Visser" <bsd@boodschappendienst.com> wrote in message news:3fe1762b$0$64969$1b62eedf@news.euronet.nl... > Hello, > > Whenever a client in my network reboots I see a warning in the eventlog > about the DHCP server issuing a NACK for the adress 192.168.0.12. We do not > use that adress anywhere in the network. I don't understand this msg, I > don't understand the things I find in the TechNet articles. > > Could somebody clarify this for me. > > Thanks in advance. > > Dieter
- Previous message: Jason LaRue: "Re: File sharing security question"
- In reply to: Dieter Visser: "Warning from DHCP server"
- Next in thread: chris_at_nospam.com: "Re: Warning from DHCP server"
- Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]
Relevant Pages
|
