Client ip address changed without notice

  • Thread starter Thread starter Eric
  • Start date Start date
E

Eric

A user in a remote office reported that they suddenly lost their
network connection.

This has happened twice in the last week to the same machine. I took a
look at their machine just now and did an ipconfig /all.

Their ip address had changed from xxx.xxx.xxx.xxx to 169.xxx.xxx.xxx.
This would explain why they lost all connection to the network because
our network in the remote office does not use 169.

The remote office has a Sonicwall that assigns IP addresses to the
machines using DHCP.

Any thoughts why a NIC adapter would change IP address during
operation without any user intervention? I'm assuming it's either the
NIC or the Sonicwall. Could some form of malicious software have
changed the IP?

Before I arrived, the user had done multiple reboots and power downs
and still could not get to the network. After I arrived and viewed the
settings, I powered down and it came back up with the correct DHCP
assigned address for our network.

Thanks,
Eric
 
A user in a remote office reported that they suddenly lost their
network connection.

This has happened twice in the last week to the same machine. I took a
look at their machine just now and did an ipconfig /all.

Their ip address had changed from xxx.xxx.xxx.xxx to 169.xxx.xxx.xxx.
This would explain why they lost all connection to the network because
our network in the remote office does not use 169.

The remote office has a Sonicwall that assigns IP addresses to the
machines using DHCP.

Any thoughts why a NIC adapter would change IP address during
operation without any user intervention? I'm assuming it's either the
NIC or the Sonicwall. Could some form of malicious software have
changed the IP?

Before I arrived, the user had done multiple reboots and power downs
and still could not get to the network. After I arrived and viewed the
settings, I powered down and it came back up with the correct DHCP
assigned address for our network.

Thanks,
Eric
Click to expand...

An auto assigned 169... IP Address indicates that the computer is
configured to obtain an address from DHCP but a connection to a DCHP server
could not be established. The cause could be anything that impacts
connectivity such as bad cable, bad NIC, bad DHCP server...
 
When DHCP server giving the IP it will tell the client
how long you can use that IP. That is IP lease time. When
the lease time cross the 50 % of time Client will ask
DHCP server can I use the IP once again. If no reply I
will not worry
But it will ask once again when it reaches to 87.5%. If
during this time if DHCP server not replies then it will
ask others can I get IP? (Send message to all)

This will get IP incase you DHCP from other application
incase they are active
Other application which gives IP are
Some proxy software, ICS (from XP System )

If nobody reply then it will assign itself 192.168.series

To over come this problem.

Increase the lease time. If u have server on remote
location install DHCP
 
in message
: A user in a remote office reported that they suddenly lost their
: network connection.
:
: This has happened twice in the last week to the same machine. I took a
: look at their machine just now and did an ipconfig /all.
:
: Their ip address had changed from xxx.xxx.xxx.xxx to 169.xxx.xxx.xxx.
: This would explain why they lost all connection to the network because
: our network in the remote office does not use 169.
:
: The remote office has a Sonicwall that assigns IP addresses to the
: machines using DHCP.
:
: Any thoughts why a NIC adapter would change IP address during
: operation without any user intervention? I'm assuming it's either the
: NIC or the Sonicwall. Could some form of malicious software have
: changed the IP?
:
: Before I arrived, the user had done multiple reboots and power downs
: and still could not get to the network. After I arrived and viewed the
: settings, I powered down and it came back up with the correct DHCP
: assigned address for our network.

The other responses are close and 169.254.x.x is part of the Automatic
Private IP Addressing (APIPA) MSFT uses but why it gets to this point has
not been fully stated.

If 50% life has passed for a DHCP lease, and a DHCP server cannot renew the
lease, then the gateway is verified. If so, then the IP address assigned
during the lease is used until 87.5% of the lease has been used and then
this repeats until the lease expires, should no DHCP server be able to renew
the lease. If that happens, then IP duplication discovery is performed, up
to 10 addresses to see if an address in the 169.254.x.x/16 range can be
used. If APIPA fails to assign and IP address, then 0.0.0.0 will be
assigned. If, however, APIPA did assign an address, every 3 minutes the
client will seek to discover a DHCP server and if one is found, then the
DHCP process will be executed as if it were a new system on the network.

How can you benefit from it?
http://www.microsoft.com/windowsxp/pro/using/howto/networking/autoconfig.asp

How can you disable it?
http://www.microsoft.com/windows200...lp/sag_TCPIP_pro_DisableAutoConfiguration.htm

Solutions to possible issues with it...
http://support.microsoft.com/defaul...port/kb/articles/Q244/2/68.ASP&NoWebContent=1

HTH...

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Online Support for IT Professionals -
http://support.microsoft.com/servicedesks/technet/default.asp?fr=0&sd=tech
How-to: Windows 2000 DNS:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;308201
 
Thank you for all of your suggestions.

I've been told that there could be a situation where if the machine is
temporarily losing it's connection and therefore assigning itself an
ip starting with 169, as confirmed by your messages.

I'm thinking that I'll probably switch the machine from DHCP and give
it a static IP address for now.

If the problem continues, I'll check the cable and then the hub for a
bad port.

There are a number of other machines on the same network. No others
are experiencing this problem. Just this one machine. And it's been on
the network for many months before this problem appeared.

Thanks,
Eric
 
in message
: Thank you for all of your suggestions.
:
: I've been told that there could be a situation where if the machine is
: temporarily losing it's connection and therefore assigning itself an
: ip starting with 169, as confirmed by your messages.
:
: I'm thinking that I'll probably switch the machine from DHCP and give
: it a static IP address for now.
:
: If the problem continues, I'll check the cable and then the hub for a
: bad port.
:
: There are a number of other machines on the same network. No others
: are experiencing this problem. Just this one machine. And it's been on
: the network for many months before this problem appeared.

Hi Eric...

You should probably check the log file to see if it is being logged when
connections are lost and perhaps that can provide some answers.

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Online Support for IT Professionals -
http://support.microsoft.com/servicedesks/technet/default.asp?fr=0&sd=tech
How-to: Windows 2000 DNS:
http://support.microsoft.com/default.aspx?scid=kb;EN-US;308201
 
You should probably check the log file to see if it is being logged when
connections are lost and perhaps that can provide some answers.
Click to expand...

Correct, I do not have it ingrained in my head to check the logs.
Sometimes there is something worth reading in them.

You were right. I saw event id 1006 DHCP corresponding to each
connection loss.

The problem was gone for a day, but the user has experienced it twice
today. I have trouble thinking that the lease could expire in such a
short time.

In another post related to the 1006 event, someone suggested
uninstalling the TCP protocol, two winsock registry entries,
restarting, and then re-installing the TCP/IP protocol.

Rebooting does reset the IP back for the time being. It seems as if
the user is away from the machine and it's inactive, when they return
the IP is reset to 169.(messages regarding application connections are
displayed).

I'm first going try set the machine's IP to a static setting, along
with all the DNS, WINS, and affiliated settings. I'll lose all of the
flexibility that DHCP gives me. I'm not really psyched to start
swapping out the NIC, network cable, hub port, hub, tcp/ip protocol,
and lastly the machine.

Thanks for your suggestion. It was right on target.

Eric
 
in message
: > You should probably check the log file to see if it is being logged when
: > connections are lost and perhaps that can provide some answers.
:
: Correct, I do not have it ingrained in my head to check the logs.
: Sometimes there is something worth reading in them.
:
: You were right. I saw event id 1006 DHCP corresponding to each
: connection loss.
:
: The problem was gone for a day, but the user has experienced it twice
: today. I have trouble thinking that the lease could expire in such a
: short time.

Have you tried running this from the command-line:

ipconfig /renew

If that doesn't work, try disabling the NIC and re-enabling it, which should
cause it to renew the IP automatically.

: In another post related to the 1006 event, someone suggested
: uninstalling the TCP protocol, two winsock registry entries,
: restarting, and then re-installing the TCP/IP protocol.

I've never had to do this on any computer, any OS.

: Rebooting does reset the IP back for the time being. It seems as if
: the user is away from the machine and it's inactive, when they return
: the IP is reset to 169.(messages regarding application connections are
: displayed).

The reason is it set to 169.* is because it lost communication with the
server and then assigned it something via APIPA. If the NIC was really bad,
then it might not be able to even do that.

If you can renew the IP then that might be worse that if you had to reboot
because if you're actually losing connectivity, when it is re-established,
it should reassign the IP automatically.

: I'm first going try set the machine's IP to a static setting, along
: with all the DNS, WINS, and affiliated settings. I'll lose all of the
: flexibility that DHCP gives me. I'm not really psyched to start
: swapping out the NIC, network cable, hub port, hub, tcp/ip protocol,
: and lastly the machine.

If the static IP loses connectivity, I would suspect the NIC or the driver
as being flakey or perhaps something else running on the computer that is
interfering. Make sure you maintain Windows Updates and if OEM drivers are
required, install them after updates.

: Thanks for your suggestion. It was right on target.

You're welcome. Intermittent issues are the hardest to resolve. Being able
to duplicate an error on demand reduces the time it takes to resolve it.
Not being able to duplicate the error on demand usually results in swapping
out hardware as a last result.

--
Roland Hall
/* This information is distributed in the hope that it will be useful, but
without any warranty; without even the implied warranty of merchantability
or fitness for a particular purpose. */
Technet Script Center - http://www.microsoft.com/technet/scriptcenter/
WSH 5.6 Documentation - http://msdn.microsoft.com/downloads/list/webdev.asp
MSDN Library - http://msdn.microsoft.com/library/default.asp
 
Back
Top