Fluctuating DHCP leases

[dgingeri]

I've got a really unusual situation for you. I've never heard of it before, and I'm betting nobody else has either. I'm just looking for ideas as to what might cause it.

I have a user in my lab with a VMware ESX 4 host. He deleted and rebuilt a Red Hat 6 VM, and the strangeness started. This VM has started randomly picking up additional DHCP leases under seemingly random MAC addresses. At first boot, it will give it's proper MAC address and get one DHCP lease, usually .5. Then, an hour (the DHCP leases are for 8 days) or so later, it will pick up a new lease, giving a random 9 digit number as its MAC address, and alter the DDNS entry. The OS keeps the first address as its IP address, but the DDNS entry no longer resolves correctly. Every hour or so, it will pick up a new one with another random number, and modify the DDNS entry. I don't get any response from pings to the addresses of the new leases, so it doesn't seem there's another machine out there with the same name. Eventually, it will use up all my leases. DHCP reservations don't do any good.

The DNS/DHCP server is a Windows 2008 R2 VM (through Hyper-V). I've set up many of them before and never had this problem. I've set up many VMware ESX machines and never seen this behavior from a VM before.

I had him set it to a static IP address and the extra leases seem to have gone away. However, he wants to move it back to DHCP. I need to find out why this is happening and make it go away. Any ideas?

 

[Electrofreak]

Might have better luck with that one on the Virtualized Computing sub-forum. You're right, I've never heard of something like that, but then, I don't do a lot with VMs.

Are the MACs absolutely random? Like, when you run them through a MAC address finder, it comes back with an invalid manufacturer? If so sounds like the VM is doing something weird, and that's about as much as I'd be able to contribute.

 

[XTF]

Run a packet sniffer

 

[dgingeri]

Might have better luck with that one on the Virtualized Computing sub-forum. You're right, I've never heard of something like that, but then, I don't do a lot with VMs.

Are the MACs absolutely random? Like, when you run them through a MAC address finder, it comes back with an invalid manufacturer? If so sounds like the VM is doing something weird, and that's about as much as I'd be able to contribute.

Well, the 9 digit numbers aren't totally random. The same 707 number comes up first every time, but they change after that.

It might be some strange RH6 thing, or something with ESX, but I have not seen this type of thing from either before. It's an older version of ESX, so it should have happened to someone else if it was a bug there. RH6 is newer, so it could potentially be something from there. I'll keep watch to see what else I can discover.

Unfortunately, I do not have, or know how to use, a packet sniffer.