DHCP server "BAD_ADDRESS" problem.

[manowar]

Hi Soulphire.

I've heard some people recommended clearing out the arp cache in the managed switches, will this harm the network at all?

 

[S0ULphIRE]

If your network is constantly changing, with new computers being swapped around and new machines connecting to different switch ports, then yes it's a good idea. Probably once a month or so, depending on exactly how fast the network changes.

BUT, if you don't connect lots of new PCs and everything kinda stays where it is, then I wouldn't bother with it very often. Maybe once every 6 months. And it's worth noting that things will slow down a touch after you've done it until the switch builds up its map again.

 

[manowar]

Cheers for the info, mate!

 

[discgolferjw]

Ok, so what's the actual filter for the bad_addresses?

tried BOOTP, but can't find "bad_address" in the BOOTP flags, and also did a filter for "frame contains bad_address" hoping it'd be text passed back & forth, but I'm not finding any clues that tell me exactly how to find it. I think I'm seeing a DHCP exhaustion attack but I want to make sure. ;-)

 

[S0ULphIRE]

bad address is the error, not the protocol. It is the error returned by the client when the offered IP address is already in use. If you're filtering via bootp, then use pic I posted above to help you. That sequence is what you *should* see, if there's a different line after the 'Offer' or 'Request' lines, then that's what you should look at.

 

[discgolferjw]

but I'd think I'd see the 600 BAD_Adresses in see in dhcp leases, as packets w/ something w/ the "frame contains bad_" string should show me something... Or a Bootstrap flag or something... ?