Announcement

Collapse
No announcement yet.

Mystery mac address in dhcp

Collapse
X
  • Filter
  • Time
  • Show
Clear All
new posts

  • Mystery mac address in dhcp

    Hi Everyone,

    I have a problem with two 2003 R2 servers that are driving me crazy.

    The problem is between two servers -

    Server 1: 64 bit DC with dhcp and dns
    Server 2: 32 bit Member server (used for various 32 bit software)

    Ok, so a bit of background...

    On server 1, we have several leases in dhcp which have no computer name. One of the leases is for 192.168.2.83.

    The mac address for that lease is 00-04-23-e2-d4-4e and I noticed that Server 2's nic's were 00-04-23-e2-d4-4c and 00-04-23-e2-d4-4d. So, I presumed that it must've been some sort of virtual mac address created by the intel nic teaming software.

    I verified that it is definitely this server by running a continuous ping from Server1 and then pulling out the lan cables on both nic's and the ping failed.

    I removed the nic teaming software entirely and restarted the server. I deleted the lease in dhcp and early this morning Server1 automatically assigned the same lease back to that mac address.

    10,02/17/12,05:13:11,Assign,192.168.2.83,,000423E2D44E

    I've tried looking through the registry on server 2 to see if there is any mention of that virtual mac address but I can't find it anywhere.

    I'm really not sure what is doing this - I don't know if perhaps the dhcp database is corrupt somehow but I doubt it. Other sites in our network have the same problem.

    If you have any ideas, i'd love to hear them as even Intel themselves couldn't give me any clues!

    Thanks!

    P.S There is no record of this ip address in both the forward and reverse lookup zones in DNS.

  • #2
    Re: Mystery mac address in dhcp

    Are you also running RRAS on this server? Does this server have any type of remote management functionallity (DRAC, ILO, etc)?

    Comment


    • #3
      Re: Mystery mac address in dhcp

      Originally posted by joeqwerty View Post
      Are you also running RRAS on this server? Does this server have any type of remote management functionallity (DRAC, ILO, etc)?
      Hi Joe,

      Nope, RRAS is disabled on both servers. They do both have an intel RMM card but it's a different IP and different mac address to the mystery one.

      Comment


      • #4
        Re: Mystery mac address in dhcp

        Well I'm out of ideas then, sorry.

        Comment


        • #5
          Re: Mystery mac address in dhcp

          Are you running a managed switch at all???

          If you are you should be able to search the switch and find out what port the machine is connected to then do some racking from there.

          Comment


          • #6
            Re: Mystery mac address in dhcp

            Originally posted by wullieb1 View Post
            Are you running a managed switch at all???

            If you are you should be able to search the switch and find out what port the machine is connected to then do some racking from there.
            The server is connected to a cisco switch so i'm going through it at the moment to see if I can find anything weird in there.

            I'm not really cluey with switches but my gut feeling is that it's still the server doing something strange. I'll let you know how I go. Thanks!

            Comment


            • #7
              Re: Mystery mac address in dhcp

              Have you disabled the 2nd NIC on the server after you removed the teaming software???

              If you didn't then you could be picking up an IP address for that card.

              What type of Cisco switch is it???

              This will show you some steps to resolve the port that the MAC is on.

              https://supportforums.cisco.com/thread/180512
              Last edited by wullieb1; 20th February 2012, 01:01.

              Comment


              • #8
                Re: Mystery mac address in dhcp

                I did disable it in the past but it is now connected to a different subnet on the 2nd port. (.3.xx).

                Telnet'd to the switch and I can see the port it's using:

                Protocol Address Age (min) Hardware Addr Type Interface
                Internet 192.168.2.83 0 0004.23e2.d44e ARPA Vlan1

                1 0004.23e2.d44c DYNAMIC Gi0/17
                1 0004.23e2.d44e DYNAMIC Gi0/17

                The command that I found online to clear the ip out the cache doesn't seem to work on this particular switch though. "clear ip arp 192.168.2.83"

                So, just trying to find out what command will work for this model (Catalyst 3650).

                Comment


                • #9
                  Re: Mystery mac address in dhcp

                  Have you traced the cable where the machine is plugged into??? Gi0/17 to the relevant patch poing then to the desktop/laptop/server.

                  Might help if you catually know which device is using it.

                  Comment


                  • #10
                    Re: Mystery mac address in dhcp

                    Yep, it's definitely the server in question that i've been talking about.

                    Comment


                    • #11
                      Re: Mystery mac address in dhcp

                      Sorry Cisco 3560 I mean.

                      Comment


                      • #12
                        Re: Mystery mac address in dhcp

                        So is the 2nd NIC getting an IP address then???

                        Comment


                        • #13
                          Re: Mystery mac address in dhcp

                          The 2nd nic address has a static address of 192.168.3.252 and is plugged into a different switch as it's on a different subnet.

                          The first nic address is 192.168.2.252 (static).

                          Comment


                          • #14
                            Re: Mystery mac address in dhcp

                            does this server have a shared DRAC/ILO port... ?
                            or is it running vmware/esx/hyperv/etc?
                            Please do show your appreciation to those who assist you by leaving Rep Point https://www.petri.com/forums/core/im.../icon_beer.gif

                            Comment


                            • #15
                              Re: Mystery mac address in dhcp

                              Hi,

                              No, it only has an intel RMM 2 remote management card - that has a different static ip of 192.168.1.252 so it's on another subnet.

                              I thought I may have fixed it last night but I can still ping this mystery address. I cleared the arp cache on the cisco switch and deleted the dhcp lease. It hasn't turned up in dhcp this morning (it usually reassigns itself over night if I delete it) but I can still ping the 192.168.2.83 address.

                              Damn annoying!

                              Comment

                              Working...
                              X