Windows 7 computers pulling phantom IP address

[batteriesnotincluded]

We have a client that now has 2 Windows 7 computers, a Dell Optiplex 780, and a Lenovo Thinkpad T500.

The issue first popped up on the T500, but now that we've put the 780 in place, it's come back.


When we first boot the computer, this is the phantom IP address we get:


Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) 82567LM-3 Gigabit Network Connec
tion
Physical Address. . . . . . . . . : B8-AC-6F-AB-8A-B2
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::647b:1207:cfca:ce9c%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.0.5(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Monday, August 30, 2010 12:35:59 PM
Lease Expires . . . . . . . . . . : Friday, October 29, 2010 12:35:59 PM
Default Gateway . . . . . . . . . :
DHCP Server . . . . . . . . . . . : 192.168.0.3
DHCPv6 IAID . . . . . . . . . . . : 246983491
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-F4-9D-C9-B8-AC-6F-AB-8A-B5
DNS Servers . . . . . . . . . . . : 192.168.0.3
68.87.72.130
NetBIOS over Tcpip. . . . . . . . : Enabled


Notice the lack of gateway server, and the extremely long lease time.


When we try to release and renew, this is the error we get in command prompt:

Windows IP Configuration
An error occurred while renewing interface Local Area Connection : The name spec
ified in the network control block (NCB) is in use on a remote adapter.
The NCB is the data.


We continue to get this error every time we try to do a renew, however if we just type in ipconfig, it will give us the new connection data.



Ethernet adapter Local Area Connection:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Intel(R) 82567LM-3 Gigabit Network Connection
Physical Address. . . . . . . . . : B8-AC-6F-AB-8A-B2
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::647b:1207:cfcb:ce9c%11(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.0.33(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : Monday, August 30, 2010 12:42:43 PM
Lease Expires . . . . . . . . . . : Thursday, September 02, 2010 12:42:43 PM
Default Gateway . . . . . . . . . : 192.168.0.254
DHCP Server . . . . . . . . . . . : 192.168.0.3
DHCPv6 IAID . . . . . . . . . . . : 246983791
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-13-F4-9D-C9-B8-AC-6F-AB-8A-B5
DNS Servers . . . . . . . . . . . : 192.168.0.3
68.87.72.130
Primary WINS Server . . . . . . . : 192.168.0.3
NetBIOS over Tcpip. . . . . . . . : Enabled


Now the gateway is set, and the lease time is down to a more respectable 4 days

.

The original IP address it's pulling (.5) is not within the scope of IP addresses our server is configured to give out, which is .20 - .140

The DHCP/DNS server is running Windows 2000. When the error first popped up, we took those functions off the Comcast Business Class SMC router, and put them back on the server, but this made no change.

The only things that I can think of off the top of my head are
a: we have some rogue DHCP server, but we only have that 1 router, and I've triple checked that DHCP was turned off. The server is configured properly. Our wireless is being done by access points. I don't know what could be doing it.
b: there is some issue with Windows 7 that somehow doesn't effect my personal laptop(which also runs Windows 7) when it connects. The two dozen or so other machines running XP never experience this issue.


Any thoughts on what could be giving us this issue? I can set the Optiplex to a static IP and get around it for now, but the laptop, I can't do that to.

 

[ambientZ]

I'd use wireshark or tcpdump to record what initial dhcp traffic that box is seeing, that should tell you who is sending them the incorrect address.

You'd want to use a hub or special switch configuration to send the traffic that box is seeing to another box as well.

 

[Krazypoloc]

You could also try this....

http://www.softpedia.com/get/Network-Tools/Network-IP-Scanner/DHCPExplorer.shtml

 

[batteriesnotincluded]

That was one of the things I was going to do.


I just tested something out again, turning off the DHCP service on the server.

I was able to pull an address, which leads me very strongly towards a rogue device. Most of the desktops here are statically assigned (I'd forgotten that), which would explain why it has only happened to the new systems.

 

[goodcooper]

it's getting that address from .3....

and the "preferred" address of .33 sounds like a modem or other isp provided network device isn't hooked up through the router correctly

 

[batteriesnotincluded]

Ok, further testing has shown that the rogue device giving out IP addresses is, in fact, the server.

DHCP was uninstalled from the server, and it still gave out IP addresses. Unplugging the server from the network stopped the rogue IP addresses.

There are no scopes enabled at this time, DHCP has not yet been reinstalled, and yet IP addresses are being given out.

Also, it affects all machines connected via DHCP, not just 7 machines.

 

[Monkey God]

Can you just block port 67 and 68 on that server until you figure out what the root cause is?

 

[batteriesnotincluded]

The particular router we're using doesn't allow internal IP for DNS scope, just outside. So, that won't work, according to our network guy.

 

[batteriesnotincluded]

Found it.

There was a service for something called "QBIK WinGate Proxy" still running, even though any proxy software the server was running was supposedly removed years ago.

No entries in the start menu, no entries in add/remove programs, no entries in startup.

 

[LoStMaTt]

Found it.

There was a service for something called "QBIK WinGate Proxy" still running, even though any proxy software the server was running was supposedly removed years ago.

No entries in the start menu, no entries in add/remove programs, no entries in startup.

I used to run QBIK Wingate VPN and E-mail server. The uninstaller does a very poor job and leaves services behind. They left it that way after a certain version because some users were getting blue screens after running uninstall. It turned out it was due to some problem with disabling and deleting the services.

 

[MavsX]

good work man. that was a weird issue going on.

 

[heatlesssun]

Interesting and educational post, thanks!