Hello All, Just a follow up to this post. I got into work this morning and found this problem occuring in overdrive!
Picture this: 1. Telnet to Router 2. "show ip dhcp conflict" shows 100 odd grat arp conflicts 3. "clear ip dhcp conflict *" 4. Sleep 30 seconds 5. "show ip dhcp conflict" shows 20 odd grat arp conflicts 6. WTF? 7. Make coffee 8. WTF? I've had a good morning so far. So given that I would rather solve the problem as opposed to just schedule a clear arp/clear conflict process to run repeatedly, and that I now had a case where it was happening "right now!", I decided to take some packet captures on the L2 segment and some debug from the affected IOS DHCP server. With "debug arp" and "debug ip dhcp server events" enabled, my debugging (Damn me for not saving it), showed that the OFFER was being made to the client, and immediately following it was an debug of arp for that offered address with "martian source", followed by "Offer declined" due to conflict. I was able to match this to the to the arp table entries and the conflict entries - each was added at the time of the "martian source" error matching the MAC of the client requesting the DHCP lease. In this way the affected client managed to steal my entire pool in a matter of minutes. I traced the MAC of the offender and shutdown the eth interface. Cleared my arps and conflicts. YAY! WORLD IS HAPPY! Then about 20 mins later, another host starts doing the same thing again. WTF!!!! So eventually, my google-fu lead me to http://support.microsoft.com/kb/928233. Now, at this point Id like to thank our dear friends at Microsoft for not making it a simple tickbox that our Helldesk Lackeys could walk somebody through. In fact, I cant even make a .reg, because the Key is based on the GUID of the interface, therefore varies depending on the PC and interface. Once again... Thankyou Microsoft. I have one of my more trusted lackeys attempting to talk a customer through changing that value on their interface, but no results yet. Fingers crossed! Kurt -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] On Behalf Of Kurt Bales Sent: Monday, 26 February 2007 16:17 To: [email protected] Subject: [c-nsp] Windows Vista, Gratuitous ARP and DHCP conflicts Hey Guys, Has anyone else noticed an increase in "Gratuitous ARP" entries under "sh ip dhcp conflict" lately? We serve Customer addresses (for better or worse!) via DHCP in some network designs. The DHCP server is running on the local Cisco Device in the area (usually an 1811). Lately we have noticed a large number of "conflicts" listed with "Gratuitous ARP" as the reason. 9 times out of 10 has shown the offending machine to be a Windows Vista install. Does anyone know why this is happening, or a way we can combat against it? We are moving our network away from DHCP addressing for customers, but this is a slow process. Is there a method to alert when the number of conflicts reaches a threshold? Regards, Kurt Bales _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/ _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
