DHCP scopes filling up

[WFHC-WI]

Hi folks,

We are experiencing an odd issue. Several Windows 2003 SP2 DHCP servers have scopes that become completely exhausted over time for no clear reason.

Refreshing the view of active leases shows nothing; however once I reconcile and verify then refresh again the leases show. They all have a lease expiration date of 24 hours from the moment I hit reconcile (our lease length
is 24 hours). They show as type DHCP/BOOTP from the GUI (MMC) and Unspecified from the command line (netsh). The servers are configured to disallow BOOTP requests. The Unique ID that appears is far too long to be a MAC address but other forums suggest this is just a mask... for example a lease for
192.168.1.10 will show as:
31 39 32 2e 31 36 38 2e 31 2e 31 30 00
Hex 31 = Decimal 49; ASCII 49 = "1"
Hex 39 = Decimal 57; ASCII 57 = "9"
Hex 32 = Decimal 50; ASCII 50 = "2"
Hex 2E = Decimal 46; ASCII 46 = "."
Hex 31 = Decimal 49; ASCII 49 = "1"
Hex 36 = Decimal 54; ASCII 54 = "6"
Hex 38 = Decimal 56; ASCII 56 = "8"
and so on...

There is a RRAS server in the environment but IPs gathered by RAS show specifically as just that, have another icon associated with them in the MMC, show the RAS server name, and never outnumber 10.

Another avenue I'm attempting to explore is Windows Automated Deployment Services 1.1. When an ADS client tries to PXE boot it sends a broadcast request. As I understood it, the ADS server picks this up and either assigns
the client a DHCP address or relays its request to a DHCP server. My ADS server is not configured as a DHCP server OR a DHCP relay agent however, yet my PXE clients (assuming there are available leases at the time) never fail to acquire an address. (Perhaps the PXE clients make their own DHCP requests?)

There are no restrictions for DHCP or PXE packets on our switches -- all are allowed through on a FIFO basis. I also see non-pingable leases being generated in this scope while no servers on the subnet are attempting PXE boots.

DHCP logs are not helping either. As an example, I removed all unidentifiable leases from a scope and found the next morning that 8 new leases were there (only by following the refresh method listed above.) I queried all of the logs for the prior week and found not a single reference to any of the IPs leased out except for my deletion!

I understand reconciling involves comparing the database to information in the registry. Perhaps if I knew where in the registry this lease info was stored I could look for clues there. I am leery of deleting and recreating
scopes and read in another post that this failed to resolve an identical issue for another user.

Any ideas?

[WFHC-WI]

Maybe someone knows how to use Wireshark or another sniffer to watch for DHCP requests from a specific range of IPs?

[John A. Myrna]

Not sure what your problem is, but I did have something similar when I deployed a few racks of HP Blades. Their iLo interfaces pulled all my available DHCP addresses.

[WFHC-WI]

Thanks for the feedback John. I think this event is a little different, my iLO IPs are assigned from a static range given to the OA instead of from my DHCP servers.

Maybe the iLO and/or OA NICs are querying the DHCP servers (which are all on the same subnet) without receiving addresses?

We plan on migrating our iLO/OA/VCM addresses to a separate VLAN in the short term future. If this resolves the issue I will be sure to update this thread but in the meantime any other guesses out there?