I have recorded a problematic DHCP behavior on a XP
station:
When the system boots up the DHCP transaction process
completes correctly (discover, offer, request and ack).

The IP of the client is set to 172.31.10.40 as received
from the DHCP server.

After 162 seconds another DHCP session with a different
transaction ID starts all over again.
The DHCP server now offers a different IP (172.31.10.46).
The client finishes the processes correctly like before
but it's IP has not changed!!!

About 100 miliseconds after the last ACK another DHCP
session starts, again a different IP is offered
(172.31.10.42) and again the client sends the request,
get and ACK and stays with the same IP as in the initial
session (172.31.10.40)!

This issue causes serious problems with the security
equipment switches which track DHCP request and authorise
access accordingly.

Does any one knows something about this?

Thanks

Noam Helfman
Developer
main.net

My first thought is this is probably going to end up as a issue with a
switch. What is the lease duration? Are all the DHCP transaction with the
smae DHCP server or is there a rogue DHCP server on the network? Do you have
a sniff?

--

Thanks,
Marc Reynolds
Microsoft Technical Support

This posting is provided "AS IS" with no warranties, and confers no rights.


"Noam Helfman" <(E-Mail Removed)> wrote in message
news:5e8e01c3e64a$b87a3150$(E-Mail Removed)...
> I have recorded a problematic DHCP behavior on a XP
> station:
> When the system boots up the DHCP transaction process
> completes correctly (discover, offer, request and ack).
>
> The IP of the client is set to 172.31.10.40 as received
> from the DHCP server.
>
> After 162 seconds another DHCP session with a different
> transaction ID starts all over again.
> The DHCP server now offers a different IP (172.31.10.46).
> The client finishes the processes correctly like before
> but it's IP has not changed!!!
>
> About 100 miliseconds after the last ACK another DHCP
> session starts, again a different IP is offered
> (172.31.10.42) and again the client sends the request,
> get and ACK and stays with the same IP as in the initial
> session (172.31.10.40)!
>
> This issue causes serious problems with the security
> equipment switches which track DHCP request and authorise
> access accordingly.
>
> Does any one knows something about this?
>
> Thanks
>
> Noam Helfman
> Developer
> main.net
>
>

Hi Marc,
The lease duration is 10 hours. All the transaction are
with the same DHCP server. I have a Ethereal capture but
I can't find a way to attach it to this message (using
web UI).
I have looked through the capture and it looks like
normal and correct DHCP transactions. The strange thing
is why the happen several times and mostly why doesn't
the client keeps the latest IP of the DHCP offer?

I will be happy to send it to you or put it in a public
FTP.

Thanks,
Noam

>-----Original Message-----
>My first thought is this is probably going to end up as
a issue with a
>switch. What is the lease duration? Are all the DHCP
transaction with the
>smae DHCP server or is there a rogue DHCP server on the
network? Do you have
>a sniff?
>
>--
>
>Thanks,
>Marc Reynolds
>Microsoft Technical Support
>
>This posting is provided "AS IS" with no warranties, and
confers no rights.
>
>
>"Noam Helfman" <(E-Mail Removed)> wrote in message
>news:5e8e01c3e64a$b87a3150$(E-Mail Removed)...
>> I have recorded a problematic DHCP behavior on a XP
>> station:
>> When the system boots up the DHCP transaction process
>> completes correctly (discover, offer, request and ack).
>>
>> The IP of the client is set to 172.31.10.40 as received
>> from the DHCP server.
>>
>> After 162 seconds another DHCP session with a different
>> transaction ID starts all over again.
>> The DHCP server now offers a different IP
(172.31.10.46).
>> The client finishes the processes correctly like before
>> but it's IP has not changed!!!
>>
>> About 100 miliseconds after the last ACK another DHCP
>> session starts, again a different IP is offered
>> (172.31.10.42) and again the client sends the request,
>> get and ACK and stays with the same IP as in the
initial
>> session (172.31.10.40)!
>>
>> This issue causes serious problems with the security
>> equipment switches which track DHCP request and
authorise
>> access accordingly.
>>
>> Does any one knows something about this?
>>
>> Thanks
>>
>> Noam Helfman
>> Developer
>> main.net
>>
>>
>
>
>.
>

here is the capture file:

Frame 1 (354 on wire, 354 captured)
Arrival Time: Jan 28, 2004 14:32:27.380654000
Time delta from previous packet: 0.000000000 seconds
Time relative to first packet: 0.000000000 seconds
Frame Number: 1
Packet Length: 354 bytes
Capture Length: 354 bytes
Ethernet II
Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Source: 00:00:e8:48:d9:46 (ACCTON_48:d9:46)
Type: IP (0x0800)
Internet Protocol, Src Addr: 0.0.0.0 (0.0.0.0), Dst Addr:
255.255.255.255 (255.255.255.255)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00:
Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint:
Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 340
Identification: 0x0000
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: UDP (0x11)
Header checksum: 0x399a (correct)
Source: 0.0.0.0 (0.0.0.0)
Destination: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootpc (68), Dst Port:
bootps (67)
Source port: bootpc (68)
Destination port: bootps (67)
Length: 320
Checksum: 0x0000 (none)
Bootstrap Protocol
Message type: Boot Request (1)
Hardware type: Ethernet
Hardware address length: 6
Hops: 0
Transaction ID: 0x1de3ca44
Seconds elapsed: 0
Bootp flags: 0x0000 (Unicast)
0... .... .... .... = Broadcast flag: Unicast
.000 0000 0000 0000 = Reserved flags: 0x0000
Client IP address: 0.0.0.0 (0.0.0.0)
Your (client) IP address: 0.0.0.0 (0.0.0.0)
Next server IP address: 0.0.0.0 (0.0.0.0)
Relay agent IP address: 0.0.0.0 (0.0.0.0)
Client hardware address: 00:00:e8:48:d9:46
Server host name not given
Boot file name not given
Magic cookie: (OK)
Option 53: DHCP Message Type = DHCP Discover
Unknown Option Code: 251 (1 bytes)
Option 61: Client identifier
Hardware type: Ethernet
Client hardware address: 00:00:e8:48:d9:46
Option 50: Requested IP Address = 212.65.22.129
Option 12: Host Name = "NT-00036a0285f4"
Option 60: Vendor class identifier = "MSFT 5.0"
Option 55: Parameter Request List
1 = Subnet Mask
15 = Domain Name
3 = Router
6 = Domain Name Server
44 = NetBIOS over TCP/IP Name Server
46 = NetBIOS over TCP/IP Node Type
47 = NetBIOS over TCP/IP Scope
31 = Perform Router Discover
33 = Static Route
43 = Vendor-Specific Information
End Option
Padding

Frame 2 (342 on wire, 342 captured)
Arrival Time: Jan 28, 2004 14:32:27.868313000
Time delta from previous packet: 0.487659000 seconds
Time relative to first packet: 0.487659000 seconds
Frame Number: 2
Packet Length: 342 bytes
Capture Length: 342 bytes
Ethernet II
Destination: 00:00:e8:48:d9:46 (ACCTON_48:d9:46)
Source: 00:01:02:dc:ad:e4 (3COM_dc:ad:e4)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.10.1 (192.168.10.1),
Dst Addr: 172.31.10.40 (172.31.10.40)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x10 (DSCP 0x04:
Unknown DSCP; ECN: 0x00)
0001 00.. = Differentiated Services Codepoint:
Unknown (0x04)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 328
Identification: 0x0000
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 16
Protocol: UDP (0x11)
Header checksum: 0x28a5 (correct)
Source: 192.168.10.1 (192.168.10.1)
Destination: 172.31.10.40 (172.31.10.40)
User Datagram Protocol, Src Port: bootps (67), Dst Port:
bootpc (68)
Source port: bootps (67)
Destination port: bootpc (68)
Length: 308
Checksum: 0xde04 (correct)
Bootstrap Protocol
Message type: Boot Reply (2)
Hardware type: Ethernet
Hardware address length: 6
Hops: 0
Transaction ID: 0x1de3ca44
Seconds elapsed: 0
Bootp flags: 0x0000 (Unicast)
0... .... .... .... = Broadcast flag: Unicast
.000 0000 0000 0000 = Reserved flags: 0x0000
Client IP address: 0.0.0.0 (0.0.0.0)
Your (client) IP address: 172.31.10.40 (172.31.10.40)
Next server IP address: 192.168.10.1 (192.168.10.1)
Relay agent IP address: 0.0.0.0 (0.0.0.0)
Client hardware address: 00:00:e8:48:d9:46
Server host name not given
Boot file name not given
Magic cookie: (OK)
Option 53: DHCP Message Type = DHCP Offer
Option 54: Server Identifier = 192.168.10.1
Option 51: IP Address Lease Time = 10 hours
Option 1: Subnet Mask = 255.255.255.0
Option 3: Router = 172.31.10.1
End Option
Padding

Frame 3 (357 on wire, 357 captured)
Arrival Time: Jan 28, 2004 14:32:27.891366000
Time delta from previous packet: 0.023053000 seconds
Time relative to first packet: 0.510712000 seconds
Frame Number: 3
Packet Length: 357 bytes
Capture Length: 357 bytes
Ethernet II
Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Source: 00:00:e8:48:d9:46 (ACCTON_48:d9:46)
Type: IP (0x0800)
Internet Protocol, Src Addr: 0.0.0.0 (0.0.0.0), Dst Addr:
255.255.255.255 (255.255.255.255)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00:
Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint:
Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 343
Identification: 0x0001
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: UDP (0x11)
Header checksum: 0x3996 (correct)
Source: 0.0.0.0 (0.0.0.0)
Destination: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootpc (68), Dst Port:
bootps (67)
Source port: bootpc (68)
Destination port: bootps (67)
Length: 323
Checksum: 0x0000 (none)
Bootstrap Protocol
Message type: Boot Request (1)
Hardware type: Ethernet
Hardware address length: 6
Hops: 0
Transaction ID: 0x1de3ca44
Seconds elapsed: 0
Bootp flags: 0x0000 (Unicast)
0... .... .... .... = Broadcast flag: Unicast
.000 0000 0000 0000 = Reserved flags: 0x0000
Client IP address: 0.0.0.0 (0.0.0.0)
Your (client) IP address: 0.0.0.0 (0.0.0.0)
Next server IP address: 0.0.0.0 (0.0.0.0)
Relay agent IP address: 0.0.0.0 (0.0.0.0)
Client hardware address: 00:00:e8:48:d9:46
Server host name not given
Boot file name not given
Magic cookie: (OK)
Option 53: DHCP Message Type = DHCP Request
Option 61: Client identifier
Hardware type: Ethernet
Client hardware address: 00:00:e8:48:d9:46
Option 50: Requested IP Address = 172.31.10.40
Option 54: Server Identifier = 192.168.10.1
Option 12: Host Name = "NT-00036a0285f4"
Option 81: Client Fully Qualified Domain Name (8
bytes)
Option 60: Vendor class identifier = "MSFT 5.0"
Option 55: Parameter Request List
1 = Subnet Mask
15 = Domain Name
3 = Router
6 = Domain Name Server
44 = NetBIOS over TCP/IP Name Server
46 = NetBIOS over TCP/IP Node Type
47 = NetBIOS over TCP/IP Scope
31 = Perform Router Discover
33 = Static Route
43 = Vendor-Specific Information
End Option

Frame 4 (342 on wire, 342 captured)
Arrival Time: Jan 28, 2004 14:32:27.903752000
Time delta from previous packet: 0.012386000 seconds
Time relative to first packet: 0.523098000 seconds
Frame Number: 4
Packet Length: 342 bytes
Capture Length: 342 bytes
Ethernet II
Destination: 00:00:e8:48:d9:46 (ACCTON_48:d9:46)
Source: 00:01:02:dc:ad:e4 (3COM_dc:ad:e4)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.10.1 (192.168.10.1),
Dst Addr: 172.31.10.40 (172.31.10.40)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x10 (DSCP 0x04:
Unknown DSCP; ECN: 0x00)
0001 00.. = Differentiated Services Codepoint:
Unknown (0x04)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 328
Identification: 0x0000
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 16
Protocol: UDP (0x11)
Header checksum: 0x28a5 (correct)
Source: 192.168.10.1 (192.168.10.1)
Destination: 172.31.10.40 (172.31.10.40)
User Datagram Protocol, Src Port: bootps (67), Dst Port:
bootpc (68)
Source port: bootps (67)
Destination port: bootpc (68)
Length: 308
Checksum: 0xdb04 (correct)
Bootstrap Protocol
Message type: Boot Reply (2)
Hardware type: Ethernet
Hardware address length: 6
Hops: 0
Transaction ID: 0x1de3ca44
Seconds elapsed: 0
Bootp flags: 0x0000 (Unicast)
0... .... .... .... = Broadcast flag: Unicast
.000 0000 0000 0000 = Reserved flags: 0x0000
Client IP address: 0.0.0.0 (0.0.0.0)
Your (client) IP address: 172.31.10.40 (172.31.10.40)
Next server IP address: 192.168.10.1 (192.168.10.1)
Relay agent IP address: 0.0.0.0 (0.0.0.0)
Client hardware address: 00:00:e8:48:d9:46
Server host name not given
Boot file name not given
Magic cookie: (OK)
Option 53: DHCP Message Type = DHCP ACK
Option 54: Server Identifier = 192.168.10.1
Option 51: IP Address Lease Time = 10 hours
Option 1: Subnet Mask = 255.255.255.0
Option 3: Router = 172.31.10.1
End Option
Padding

Frame 5 (364 on wire, 364 captured)
Arrival Time: Jan 28, 2004 14:35:11.279261000
Time delta from previous packet: 163.375509000 seconds
Time relative to first packet: 163.898607000 seconds
Frame Number: 5
Packet Length: 364 bytes
Capture Length: 364 bytes
Ethernet II
Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Source: 00:00:e8:48:d9:46 (ACCTON_48:d9:46)
Type: IP (0x0800)
Internet Protocol, Src Addr: 172.31.10.40 (172.31.10.40),
Dst Addr: 255.255.255.255 (255.255.255.255)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00:
Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint:
Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 350
Identification: 0x005b
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: UDP (0x11)
Header checksum: 0x82ed (correct)
Source: 172.31.10.40 (172.31.10.40)
Destination: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootpc (68), Dst Port:
bootps (67)
Source port: bootpc (68)
Destination port: bootps (67)
Length: 330
Checksum: 0x0000 (none)
Bootstrap Protocol
Message type: Boot Request (1)
Hardware type: Ethernet
Hardware address length: 6
Hops: 0
Transaction ID: 0x27a89e52
Seconds elapsed: 0
Bootp flags: 0x8000 (Broadcast)
1... .... .... .... = Broadcast flag: Broadcast
.000 0000 0000 0000 = Reserved flags: 0x0000
Client IP address: 0.0.0.0 (0.0.0.0)
Your (client) IP address: 0.0.0.0 (0.0.0.0)
Next server IP address: 0.0.0.0 (0.0.0.0)
Relay agent IP address: 0.0.0.0 (0.0.0.0)
Client hardware address: 00:00:e8:48:d9:46
Server host name not given
Boot file name not given
Magic cookie: (OK)
Option 53: DHCP Message Type = DHCP Discover
Option 77: User Class Information (14 bytes)
Unknown Option Code: 251 (1 bytes)
Option 61: Client identifier (17 bytes)
Option 12: Host Name = "NT-00036a0285f4"
Option 60: Vendor class identifier = "MSFT 5.0"
Option 55: Parameter Request List
1 = Subnet Mask
15 = Domain Name
3 = Router
6 = Domain Name Server
44 = NetBIOS over TCP/IP Name Server
46 = NetBIOS over TCP/IP Node Type
47 = NetBIOS over TCP/IP Scope
31 = Perform Router Discover
33 = Static Route
43 = Vendor-Specific Information
End Option

Frame 6 (342 on wire, 342 captured)
Arrival Time: Jan 28, 2004 14:35:11.880665000
Time delta from previous packet: 0.601404000 seconds
Time relative to first packet: 164.500011000 seconds
Frame Number: 6
Packet Length: 342 bytes
Capture Length: 342 bytes
Ethernet II
Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Source: 00:01:02:dc:ad:e4 (3COM_dc:ad:e4)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.10.1 (192.168.10.1),
Dst Addr: 255.255.255.255 (255.255.255.255)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x10 (DSCP 0x04:
Unknown DSCP; ECN: 0x00)
0001 00.. = Differentiated Services Codepoint:
Unknown (0x04)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 328
Identification: 0x0000
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 16
Protocol: UDP (0x11)
Header checksum: 0xdeec (correct)
Source: 192.168.10.1 (192.168.10.1)
Destination: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootps (67), Dst Port:
bootpc (68)
Source port: bootps (67)
Destination port: bootpc (68)
Length: 308
Checksum: 0x3671 (correct)
Bootstrap Protocol
Message type: Boot Reply (2)
Hardware type: Ethernet
Hardware address length: 6
Hops: 0
Transaction ID: 0x27a89e52
Seconds elapsed: 0
Bootp flags: 0x8000 (Broadcast)
1... .... .... .... = Broadcast flag: Broadcast
.000 0000 0000 0000 = Reserved flags: 0x0000
Client IP address: 0.0.0.0 (0.0.0.0)
Your (client) IP address: 172.31.10.48 (172.31.10.48)
Next server IP address: 192.168.10.1 (192.168.10.1)
Relay agent IP address: 0.0.0.0 (0.0.0.0)
Client hardware address: 00:00:e8:48:d9:46
Server host name not given
Boot file name not given
Magic cookie: (OK)
Option 53: DHCP Message Type = DHCP Offer
Option 54: Server Identifier = 192.168.10.1
Option 51: IP Address Lease Time = 10 hours
Option 1: Subnet Mask = 255.255.255.0
Option 3: Router = 172.31.10.1
End Option
Padding

Frame 7 (373 on wire, 373 captured)
Arrival Time: Jan 28, 2004 14:35:11.903613000
Time delta from previous packet: 0.022948000 seconds
Time relative to first packet: 164.522959000 seconds
Frame Number: 7
Packet Length: 373 bytes
Capture Length: 373 bytes
Ethernet II
Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Source: 00:00:e8:48:d9:46 (ACCTON_48:d9:46)
Type: IP (0x0800)
Internet Protocol, Src Addr: 172.31.10.40 (172.31.10.40),
Dst Addr: 255.255.255.255 (255.255.255.255)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00:
Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint:
Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 359
Identification: 0x005d
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: UDP (0x11)
Header checksum: 0x82e2 (correct)
Source: 172.31.10.40 (172.31.10.40)
Destination: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootpc (68), Dst Port:
bootps (67)
Source port: bootpc (68)
Destination port: bootps (67)
Length: 339
Checksum: 0x0000 (none)
Bootstrap Protocol
Message type: Boot Request (1)
Hardware type: Ethernet
Hardware address length: 6
Hops: 0
Transaction ID: 0x27a89e52
Seconds elapsed: 0
Bootp flags: 0x8000 (Broadcast)
1... .... .... .... = Broadcast flag: Broadcast
.000 0000 0000 0000 = Reserved flags: 0x0000
Client IP address: 0.0.0.0 (0.0.0.0)
Your (client) IP address: 0.0.0.0 (0.0.0.0)
Next server IP address: 0.0.0.0 (0.0.0.0)
Relay agent IP address: 0.0.0.0 (0.0.0.0)
Client hardware address: 00:00:e8:48:d9:46
Server host name not given
Boot file name not given
Magic cookie: (OK)
Option 53: DHCP Message Type = DHCP Request
Option 77: User Class Information (14 bytes)
Option 61: Client identifier (17 bytes)
Option 50: Requested IP Address = 172.31.10.48
Option 54: Server Identifier = 192.168.10.1
Option 12: Host Name = "NT-00036a0285f4"
Option 60: Vendor class identifier = "MSFT 5.0"
Option 55: Parameter Request List
1 = Subnet Mask
15 = Domain Name
3 = Router
6 = Domain Name Server
44 = NetBIOS over TCP/IP Name Server
46 = NetBIOS over TCP/IP Node Type
47 = NetBIOS over TCP/IP Scope
31 = Perform Router Discover
33 = Static Route
43 = Vendor-Specific Information
End Option

Frame 8 (342 on wire, 342 captured)
Arrival Time: Jan 28, 2004 14:35:11.906087000
Time delta from previous packet: 0.002474000 seconds
Time relative to first packet: 164.525433000 seconds
Frame Number: 8
Packet Length: 342 bytes
Capture Length: 342 bytes
Ethernet II
Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Source: 00:01:02:dc:ad:e4 (3COM_dc:ad:e4)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.10.1 (192.168.10.1),
Dst Addr: 255.255.255.255 (255.255.255.255)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x10 (DSCP 0x04:
Unknown DSCP; ECN: 0x00)
0001 00.. = Differentiated Services Codepoint:
Unknown (0x04)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 328
Identification: 0x0000
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 16
Protocol: UDP (0x11)
Header checksum: 0xdeec (correct)
Source: 192.168.10.1 (192.168.10.1)
Destination: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootps (67), Dst Port:
bootpc (68)
Source port: bootps (67)
Destination port: bootpc (68)
Length: 308
Checksum: 0x3371 (correct)
Bootstrap Protocol
Message type: Boot Reply (2)
Hardware type: Ethernet
Hardware address length: 6
Hops: 0
Transaction ID: 0x27a89e52
Seconds elapsed: 0
Bootp flags: 0x8000 (Broadcast)
1... .... .... .... = Broadcast flag: Broadcast
.000 0000 0000 0000 = Reserved flags: 0x0000
Client IP address: 0.0.0.0 (0.0.0.0)
Your (client) IP address: 172.31.10.48 (172.31.10.48)
Next server IP address: 192.168.10.1 (192.168.10.1)
Relay agent IP address: 0.0.0.0 (0.0.0.0)
Client hardware address: 00:00:e8:48:d9:46
Server host name not given
Boot file name not given
Magic cookie: (OK)
Option 53: DHCP Message Type = DHCP ACK
Option 54: Server Identifier = 192.168.10.1
Option 51: IP Address Lease Time = 10 hours
Option 1: Subnet Mask = 255.255.255.0
Option 3: Router = 172.31.10.1
End Option
Padding

Frame 9 (364 on wire, 364 captured)
Arrival Time: Jan 28, 2004 14:35:11.995701000
Time delta from previous packet: 0.089614000 seconds
Time relative to first packet: 164.615047000 seconds
Frame Number: 9
Packet Length: 364 bytes
Capture Length: 364 bytes
Ethernet II
Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Source: 00:00:e8:48:d9:46 (ACCTON_48:d9:46)
Type: IP (0x0800)
Internet Protocol, Src Addr: 172.31.10.40 (172.31.10.40),
Dst Addr: 255.255.255.255 (255.255.255.255)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00:
Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint:
Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 350
Identification: 0x005e
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: UDP (0x11)
Header checksum: 0x82ea (correct)
Source: 172.31.10.40 (172.31.10.40)
Destination: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootpc (68), Dst Port:
bootps (67)
Source port: bootpc (68)
Destination port: bootps (67)
Length: 330
Checksum: 0x0000 (none)
Bootstrap Protocol
Message type: Boot Request (1)
Hardware type: Ethernet
Hardware address length: 6
Hops: 0
Transaction ID: 0x27b394b3
Seconds elapsed: 0
Bootp flags: 0x8000 (Broadcast)
1... .... .... .... = Broadcast flag: Broadcast
.000 0000 0000 0000 = Reserved flags: 0x0000
Client IP address: 0.0.0.0 (0.0.0.0)
Your (client) IP address: 0.0.0.0 (0.0.0.0)
Next server IP address: 0.0.0.0 (0.0.0.0)
Relay agent IP address: 0.0.0.0 (0.0.0.0)
Client hardware address: 00:00:e8:48:d9:46
Server host name not given
Boot file name not given
Magic cookie: (OK)
Option 53: DHCP Message Type = DHCP Discover
Option 77: User Class Information (14 bytes)
Unknown Option Code: 251 (1 bytes)
Option 61: Client identifier (17 bytes)
Option 12: Host Name = "NT-00036a0285f4"
Option 60: Vendor class identifier = "MSFT 5.0"
Option 55: Parameter Request List
1 = Subnet Mask
15 = Domain Name
3 = Router
6 = Domain Name Server
44 = NetBIOS over TCP/IP Name Server
46 = NetBIOS over TCP/IP Node Type
47 = NetBIOS over TCP/IP Scope
31 = Perform Router Discover
33 = Static Route
43 = Vendor-Specific Information
End Option

Frame 10 (342 on wire, 342 captured)
Arrival Time: Jan 28, 2004 14:35:12.880683000
Time delta from previous packet: 0.884982000 seconds
Time relative to first packet: 165.500029000 seconds
Frame Number: 10
Packet Length: 342 bytes
Capture Length: 342 bytes
Ethernet II
Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Source: 00:01:02:dc:ad:e4 (3COM_dc:ad:e4)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.10.1 (192.168.10.1),
Dst Addr: 255.255.255.255 (255.255.255.255)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x10 (DSCP 0x04:
Unknown DSCP; ECN: 0x00)
0001 00.. = Differentiated Services Codepoint:
Unknown (0x04)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 328
Identification: 0x0000
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 16
Protocol: UDP (0x11)
Header checksum: 0xdeec (correct)
Source: 192.168.10.1 (192.168.10.1)
Destination: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootps (67), Dst Port:
bootpc (68)
Source port: bootps (67)
Destination port: bootpc (68)
Length: 308
Checksum: 0x400b (correct)
Bootstrap Protocol
Message type: Boot Reply (2)
Hardware type: Ethernet
Hardware address length: 6
Hops: 0
Transaction ID: 0x27b394b3
Seconds elapsed: 0
Bootp flags: 0x8000 (Broadcast)
1... .... .... .... = Broadcast flag: Broadcast
.000 0000 0000 0000 = Reserved flags: 0x0000
Client IP address: 0.0.0.0 (0.0.0.0)
Your (client) IP address: 172.31.10.42 (172.31.10.42)
Next server IP address: 192.168.10.1 (192.168.10.1)
Relay agent IP address: 0.0.0.0 (0.0.0.0)
Client hardware address: 00:00:e8:48:d9:46
Server host name not given
Boot file name not given
Magic cookie: (OK)
Option 53: DHCP Message Type = DHCP Offer
Option 54: Server Identifier = 192.168.10.1
Option 51: IP Address Lease Time = 10 hours
Option 1: Subnet Mask = 255.255.255.0
Option 3: Router = 172.31.10.1
End Option
Padding

Frame 11 (373 on wire, 373 captured)
Arrival Time: Jan 28, 2004 14:35:12.901276000
Time delta from previous packet: 0.020593000 seconds
Time relative to first packet: 165.520622000 seconds
Frame Number: 11
Packet Length: 373 bytes
Capture Length: 373 bytes
Ethernet II
Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Source: 00:00:e8:48:d9:46 (ACCTON_48:d9:46)
Type: IP (0x0800)
Internet Protocol, Src Addr: 172.31.10.40 (172.31.10.40),
Dst Addr: 255.255.255.255 (255.255.255.255)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x00 (DSCP 0x00:
Default; ECN: 0x00)
0000 00.. = Differentiated Services Codepoint:
Default (0x00)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 359
Identification: 0x005f
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 128
Protocol: UDP (0x11)
Header checksum: 0x82e0 (correct)
Source: 172.31.10.40 (172.31.10.40)
Destination: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootpc (68), Dst Port:
bootps (67)
Source port: bootpc (68)
Destination port: bootps (67)
Length: 339
Checksum: 0x0000 (none)
Bootstrap Protocol
Message type: Boot Request (1)
Hardware type: Ethernet
Hardware address length: 6
Hops: 0
Transaction ID: 0x27b394b3
Seconds elapsed: 0
Bootp flags: 0x8000 (Broadcast)
1... .... .... .... = Broadcast flag: Broadcast
.000 0000 0000 0000 = Reserved flags: 0x0000
Client IP address: 0.0.0.0 (0.0.0.0)
Your (client) IP address: 0.0.0.0 (0.0.0.0)
Next server IP address: 0.0.0.0 (0.0.0.0)
Relay agent IP address: 0.0.0.0 (0.0.0.0)
Client hardware address: 00:00:e8:48:d9:46
Server host name not given
Boot file name not given
Magic cookie: (OK)
Option 53: DHCP Message Type = DHCP Request
Option 77: User Class Information (14 bytes)
Option 61: Client identifier (17 bytes)
Option 50: Requested IP Address = 172.31.10.42
Option 54: Server Identifier = 192.168.10.1
Option 12: Host Name = "NT-00036a0285f4"
Option 60: Vendor class identifier = "MSFT 5.0"
Option 55: Parameter Request List
1 = Subnet Mask
15 = Domain Name
3 = Router
6 = Domain Name Server
44 = NetBIOS over TCP/IP Name Server
46 = NetBIOS over TCP/IP Node Type
47 = NetBIOS over TCP/IP Scope
31 = Perform Router Discover
33 = Static Route
43 = Vendor-Specific Information
End Option

Frame 12 (342 on wire, 342 captured)
Arrival Time: Jan 28, 2004 14:35:12.903639000
Time delta from previous packet: 0.002363000 seconds
Time relative to first packet: 165.522985000 seconds
Frame Number: 12
Packet Length: 342 bytes
Capture Length: 342 bytes
Ethernet II
Destination: ff:ff:ff:ff:ff:ff (ff:ff:ff:ff:ff:ff)
Source: 00:01:02:dc:ad:e4 (3COM_dc:ad:e4)
Type: IP (0x0800)
Internet Protocol, Src Addr: 192.168.10.1 (192.168.10.1),
Dst Addr: 255.255.255.255 (255.255.255.255)
Version: 4
Header length: 20 bytes
Differentiated Services Field: 0x10 (DSCP 0x04:
Unknown DSCP; ECN: 0x00)
0001 00.. = Differentiated Services Codepoint:
Unknown (0x04)
.... ..0. = ECN-Capable Transport (ECT): 0
.... ...0 = ECN-CE: 0
Total Length: 328
Identification: 0x0000
Flags: 0x00
.0.. = Don't fragment: Not set
..0. = More fragments: Not set
Fragment offset: 0
Time to live: 16
Protocol: UDP (0x11)
Header checksum: 0xdeec (correct)
Source: 192.168.10.1 (192.168.10.1)
Destination: 255.255.255.255 (255.255.255.255)
User Datagram Protocol, Src Port: bootps (67), Dst Port:
bootpc (68)
Source port: bootps (67)
Destination port: bootpc (68)
Length: 308
Checksum: 0x3d0b (correct)
Bootstrap Protocol
Message type: Boot Reply (2)
Hardware type: Ethernet
Hardware address length: 6
Hops: 0
Transaction ID: 0x27b394b3
Seconds elapsed: 0
Bootp flags: 0x8000 (Broadcast)
1... .... .... .... = Broadcast flag: Broadcast
.000 0000 0000 0000 = Reserved flags: 0x0000
Client IP address: 0.0.0.0 (0.0.0.0)
Your (client) IP address: 172.31.10.42 (172.31.10.42)
Next server IP address: 192.168.10.1 (192.168.10.1)
Relay agent IP address: 0.0.0.0 (0.0.0.0)
Client hardware address: 00:00:e8:48:d9:46
Server host name not given
Boot file name not given
Magic cookie: (OK)
Option 53: DHCP Message Type = DHCP ACK
Option 54: Server Identifier = 192.168.10.1
Option 51: IP Address Lease Time = 10 hours
Option 1: Subnet Mask = 255.255.255.0
Option 3: Router = 172.31.10.1
End Option
Padding



>-----Original Message-----
>My first thought is this is probably going to end up as
a issue with a
>switch. What is the lease duration? Are all the DHCP
transaction with the
>smae DHCP server or is there a rogue DHCP server on the
network? Do you have
>a sniff?
>
>--
>
>Thanks,
>Marc Reynolds
>Microsoft Technical Support
>
>This posting is provided "AS IS" with no warranties, and
confers no rights.
>
>
>"Noam Helfman" <(E-Mail Removed)> wrote in message
>news:5e8e01c3e64a$b87a3150$(E-Mail Removed)...
>> I have recorded a problematic DHCP behavior on a XP
>> station:
>> When the system boots up the DHCP transaction process
>> completes correctly (discover, offer, request and ack).
>>
>> The IP of the client is set to 172.31.10.40 as received
>> from the DHCP server.
>>
>> After 162 seconds another DHCP session with a different
>> transaction ID starts all over again.
>> The DHCP server now offers a different IP
(172.31.10.46).
>> The client finishes the processes correctly like before
>> but it's IP has not changed!!!
>>
>> About 100 miliseconds after the last ACK another DHCP
>> session starts, again a different IP is offered
>> (172.31.10.42) and again the client sends the request,
>> get and ACK and stays with the same IP as in the
initial
>> session (172.31.10.40)!
>>
>> This issue causes serious problems with the security
>> equipment switches which track DHCP request and
authorise
>> access accordingly.
>>
>> Does any one knows something about this?
>>
>> Thanks
>>
>> Noam Helfman
>> Developer
>> main.net
>>
>>
>
>
>.
>

Hi Noam,

Please email the capture. Just drop the "online" from my listed email
address. I'll try to review it tomorrow.


--

Thanks,
Marc Reynolds
Microsoft Technical Support

This posting is provided "AS IS" with no warranties, and confers no rights.


"Noam Helfman" <(E-Mail Removed)> wrote in message
news:6ac101c3e67e$4085e390$(E-Mail Removed)...
> Hi Marc,
> The lease duration is 10 hours. All the transaction are
> with the same DHCP server. I have a Ethereal capture but
> I can't find a way to attach it to this message (using
> web UI).
> I have looked through the capture and it looks like
> normal and correct DHCP transactions. The strange thing
> is why the happen several times and mostly why doesn't
> the client keeps the latest IP of the DHCP offer?
>
> I will be happy to send it to you or put it in a public
> FTP.
>
> Thanks,
> Noam
>
> >-----Original Message-----
> >My first thought is this is probably going to end up as
> a issue with a
> >switch. What is the lease duration? Are all the DHCP
> transaction with the
> >smae DHCP server or is there a rogue DHCP server on the
> network? Do you have
> >a sniff?
> >
> >--
> >
> >Thanks,
> >Marc Reynolds
> >Microsoft Technical Support
> >
> >This posting is provided "AS IS" with no warranties, and
> confers no rights.
> >
> >
> >"Noam Helfman" <(E-Mail Removed)> wrote in message
> >news:5e8e01c3e64a$b87a3150$(E-Mail Removed)...
> >> I have recorded a problematic DHCP behavior on a XP
> >> station:
> >> When the system boots up the DHCP transaction process
> >> completes correctly (discover, offer, request and ack).
> >>
> >> The IP of the client is set to 172.31.10.40 as received
> >> from the DHCP server.
> >>
> >> After 162 seconds another DHCP session with a different
> >> transaction ID starts all over again.
> >> The DHCP server now offers a different IP
> (172.31.10.46).
> >> The client finishes the processes correctly like before
> >> but it's IP has not changed!!!
> >>
> >> About 100 miliseconds after the last ACK another DHCP
> >> session starts, again a different IP is offered
> >> (172.31.10.42) and again the client sends the request,
> >> get and ACK and stays with the same IP as in the
> initial
> >> session (172.31.10.40)!
> >>
> >> This issue causes serious problems with the security
> >> equipment switches which track DHCP request and
> authorise
> >> access accordingly.
> >>
> >> Does any one knows something about this?
> >>
> >> Thanks
> >>
> >> Noam Helfman
> >> Developer
> >> main.net
> >>
> >>
> >
> >
> >.
> >