Client PC Repeatedly requesting for IP Address in our DHCP Server

[Guest]

Our DHCP Server keeps on giving out an IP address that has spoofed MAC
Address until our entire pool of addresses in our DHCP server is all leased.
We suspect that there is a client PC out in our our network that is doing
this but we are not sure where to begin or find it. I ran DHCPLOC.exe to find
if there is any rogue dhcp and I keep on seeing one of our VLAN getting
acknowlegement for IP's an we don't know where the source is. We have about
4500 PC's out there but this one seems to be happening only in one building
that has 1500 PC's on it. Please help us narrow down how we going to detect
this PC or device. Thank you in advance.

 

[pscyime]

Hi

If I understand you correctly .......

Your DHCP server is leasing IP addresses to a series of spoofed MACs until the address pool is empty...yes?

I dont know off hand how to isolate the offending machine , however in the DHCP mmc what does it list the computer name as ?(the one it has leased the address too) also are you bang up to date with patches,sp's,antivirus signatures etc

Hopefully one of the pro's knows a way to locate said machine......if your lucky

Regards

S