Take the 2-minute tour ×

Our WIndows Server 2003 DHCP scope is being filled with BAD ADDRESS leases. This happened after we started deploying Vista to the domain. It is most prevalent when a user disconnects from their wired connection and plugs back in on an alternate location.

I have ran wireshark on the DHCP server and can see the client machine refusing the DHCP address. The client requests the DHCP Address as evidenced by a DHCP REQUEST entry in the wireshark log and this is immediately followed by a DHCP DECLINED entry. It is a limited number of laptops affected by this (only Vista so far, it does affect our XP and other laptops when we run out of addresses though) The addresses it declines are valid and not currently in use.

I have turned of conflict detection on the DHCP server but it is still filling it with BAD ADDRESS entries. In these cases the user cannot get an IP address.

Another possibly related issue is that there are several users reporting IP Address Conflict messages on their laptops and workstations. These are all served from the same DHCP server. The problem is most apparent when they disconnect either wired or wireless connections or bring their machines out of hibernate mode.

My belief is that this is caused by something in Vista but it has not been resolved by deploying SP2. All machines that users report both issues (NOt able to get an address, IP address conflict) are running Vista while machines running XP get only the IP Address conflict message.

THe DHCP Lease time is 3 days. Should this be reduced? Should I reenable conflict detection? Or should I just put XP SP3 on the machines that I can?

There are 2 DHCP servers in play, they share the same scope but have mutual exclusions, it's to cover us in the event of a failure as per the 80:20 rule. The problem occurred before I added the second DHCP server.

I have scanned the network for rogue DHCP servers, I have also disabled our DHCP server (only one at that time) and requested a DHCP address, none was received.

Also, most of the machines affected have virtual PC or virtual server running.

share|improve this question
The problem appears to stem from Symantec Endpoint Protection 11.04 and it's network threat detection. Disabling this on the server to see if it fixes the issue. On another note I do NOT like applications installing dummy drivers "For Your Protection" –  Dan Jun 16 '09 at 8:48
add comment

6 Answers

BAD_ADDRESS is IP address confliction, so the DHCP-server obviously gets a reply when it tries to ping those addresses. Have you tried using ping manually from the DHCP server? You could also try to look at the arp cache (arp -a in a commandline shell).

share|improve this answer
The IP addresses are definitely not live. I've tried pinging them and get no response (from the DHCP server box) I haven't looked at the ARP cache yet –  Dan Jun 11 '09 at 15:20
Windows firewall drops incoming icmp echo requests by default, look at your ARP cache after the ping. –  pauska Jun 11 '09 at 15:37
pauska, great advice, upvote for you! :) –  Greg Meehan Jun 11 '09 at 16:13
add comment
up vote 2 down vote accepted

Our problem stemmed from a particular set of circumstances. Vista SP1 + SP2
"Mobile" users
Incomplete Wireless coverage with poor handover
Users putting their machines into hibernate and moving them off and on the network

This caused Symantec Endpoint Protection, specifically the Network Threat Protection component to throw a fit. Disabling this component and the problem has not reoccurred. I'm 99% confident that it was symantec as we experienced the exact same issue on another site that had symantec deployed that day.

The fix for this is to reboot the problematic machine and disable Network Threat Protection. We have a call logged with Symantec to see if this is a known issue or a potential misconfiguration. I am strongly considering recommending a move away from Symantec and sleecting trend as our A/V provider.

share|improve this answer
please note, after redeploying SEP without Network Threat Protection we have had no issues with DHCP. Make of that what you will. –  Dan Feb 19 '10 at 13:40
add comment

I don't believe that this is an inherent vista issue. No version of Vista has had this problem in our mixed environment. Could it be that some how, the NIC cards in the Vista machines were reflashed to have the same MAC address? I think that would have those symptoms. You say that wireshark shows the vista machines refusing DHCP address. Did they ask for it and then refuse it? Could a weirdo nic driver cause this problem?

Another thought is that Vista does attempt to detect what network you are on so that it can set the firewalls appropriately. When you move machine from one location to another, is it clearly a different subnet or does it share the same IP range?

share|improve this answer
There is a possibility that it could be a weird NIC issue as they are all dell laptops with the same cards. It's the same subnet, server and wired/wireless network (wireless bridges in play allowing roaming the building - I don't agree with it but it has to stay) The machine actively asks for it as evidenced by the DHCP Request swiftly followed by a DHCP Decline –  Dan Jun 11 '09 at 15:23
Also, is there a way to tell vista that EVERY network you connect to is type XYZ so it doesn't waste time mucking about trying to find out what it is. –  Dan Jun 11 '09 at 15:30
NIC card .... gaaaah! –  Joseph Kern Jun 15 '09 at 11:03
I know, "welcome to the department of redundancy department" –  Dan Sep 15 '09 at 16:04
Guilty as charged. :) –  Knox Sep 15 '09 at 17:06
add comment

I agree with pauska, it's ip address conflicts. You MAY have;

a.) Another overlapping DHCP server issuing addresses, which is conflicting with the scope that you're issuing now.

b.) I agree wholeheartedly with reducing the lease time. I would set it to 8 hours or so, and delete the "BAD_ADDRESS" entries. You'll see more conflicts, but as the workstations let the addresses go, they'll renew OK. (Provided you don't have a rogue DHCP server out there! :)

If you begin to get reports of offending workstations getting the "ip address conflict!" messages, run "ipconfig /release && ipconfig /renew" on the problematic machines.

Oh, also.. Be forewarned, if you're using AD-integrated dynamic DNS, where your machines automatically update themselves in your DC's, once you kick down that lease time, you're going to need to compensate by scavenging those DNS entries. Maybe you could append that line up there and add, "&& ipconfig /registerdns"


share|improve this answer
a. There is an overlapping DHCP Server with the same scope but it has exclusions for the primary DHCP so they don't share the address pool (80:20 rule) b. I'm going to set this shortly I am using AD Integrated DNS, is there a way to automate the harvesting of DNS entries or is it just a matter of waiting? –  Dan Jun 11 '09 at 15:24
Ahh!!! It may have exclusions, but I'm willing to bet a beer at the pub that's where you're running into some of your issues.. There is a way to automate it, if I understand you correctly; open properties for your domain in DNS admin tool, click on "Aging" and make sure those settings jive. –  Greg Meehan Jun 11 '09 at 16:12
I've shortened the lease to 8 hrs, disabled the second DHCP server and we are still experiencing the BAD ADDRESS Entries. There are no entries in the event logs for the server affected. –  Dan Jun 15 '09 at 11:44
Ah! Hey, I was kinda wondering what ever happened with Dan-and-his-DHCP. Hmmm. A quandry for sure. Is there any way you can temporarily disable the other DHCP scope for testing purposes? Setting those address leases for a super-long time, or assigning static IP addresses? –  Greg Meehan Jun 15 '09 at 13:50
I find that my Vista laptop has a tendency to do strange things if it is put into Hibernate with it's wireless card active. I don't know if that has anything to do with what you are seeing, but can you convince your users to disable their wireless card before putting their laptops to sleep? At least long enough to see if that fixes the problem. –  Catherine MacInnes Jun 15 '09 at 15:55
add comment

It's a problem with the broadcast flag in DHCP in Vista.

Check out this article for fixing your DHCP problems. http://thedaneshproject.com/posts/vista-not-working-with-dhcp/

share|improve this answer
add comment

Just Make IP to Mac Binding or in simple words just reserve those IPs in DHCP which showing as Bad address. It would work fine

share|improve this answer
This only works if you aren't managing 200+ machines. It's not really feasible to have MAC binding in DHCP for this type of purpose. I don't think it would have worked in this situation as SEP was blocking the firewall request. –  Dan Mar 1 '12 at 9:06
add comment

Your Answer


