Leopard server, Tiger clients, 'IP address in use' error messages

Question

I am really at my wit's end here. We have about 100 iBooks running 10.4.11 and a couple hundred MacBooks running Leopard. I took away the job of DHCP from my Windows Server 2003 servers because it couldn't seem to keep the Tiger clients straight, and now the Leopard server is doing the same thing. The laptops are shut down and booted often 10 times a day for use in different classes by different students in different segments of the building, but all the same subnet. Very often, iBooks get an "IP in use by [some other Mac's MAC address], server [IP address of Xserve]" it looks just like this: http://podfeet.com/NosillaCast/NC2006_05_21/iperror.jpg
In addition, when I go to look up the client list on the Leopard server via Server Admin, it shows several instances of the same computer name, same MAC address, different IP address, as well as same computer name, different MAC address, same IP address, and, of course, same IP address for two or three different computers. This is as bad as, if not worse, than Windows server! But it's only the Tiger clients, and I can easily see the duplications in the list, why can't the server see that and do something about it?
I am going to be moving to SL server, but not soon enough. Apparently, it's much easier to assign static IP assignments in SL server than Leopard server. I need a resolution for this now, though. I have Googled quite a bit, but nothing I've found matches my situation. And it causes chaos. After the students clear away the IP conflict box, they often cannot log in until a local admin logs in and "renews IP address" or they restart and clear the error boxes until it gets an IP address it will accept.
I can paste in some console logs if that would help, but essentially, the client refuses the IP address offered by the server, so that suggests that it arps the address itself and determines it's already in use. This whole system, which should be so intelligent, seems so clueless. Why doesn't the server realize it's giving the same IP to different computers, listing the same computers twice with the same and different IPs, etc.? Why doesn't the laptop keep trying to get an IP address? It's extremely frustrating for teachers and students alike.
I really thought this would get better using Leopard server instead of the Windows server, but it actually seems worse now. I've done tests to see if there is a different DHCP server somewhere, but none ever shows up.
Anyone with insight, I'd appreciate it. Thanks

Answer 1

MrHoffman wrote:
One big 172.16.0.0/12 subnet? Ok. Not my first choice.
It's /16, but still was not my choice either. With about 50 printers and servers with static IPs that would all need the mask changed, I put off clipping the subnet mask since VLANs were in the works anyway.
MrHoffman wrote:
The network traffic for a DHCP lease or a lease renewal is negligible.
Figure a few messages at intervals of half the lease time for each client.
There already appears to be a DHCP failure here.
I tried many different things with the 2003 Servers, usually two at a time handing out IPs (same subnet, different range, i.e. one serving 172.16.2.1-3.254/16 and the other 172.16.4.1-5.254/16), and the iBooks would often sit for minutes without getting an IP at all. I'd have to turn on the Xserve's DHCP server to hand out an additional range in the subnet (172.16.6.1-254/16), and the iBooks would then snap up IPs and authenticate to AD.
MrHoffman wrote:
And as for the weirdness, I'd be wondering if the DHCP traffic is being filtered by some of the devices present in this network; it's very easy to have a DHCP server active on a WiFi device (which is why most larger sites have them all configured as APs) and it's also easily feasible to have a rogue WiFi around.
Thanks, all good ideas, but I don't think the problem here. I have all Airport Extreme base stations in Bridge Mode. I regularly do scans for rogue APs, and the iBooks would not associate to one anyway - they only know the school network and need admin access to change. In fact, so inflexible is Tiger that when I started changing to WPA2 from WPA, same SSID and password, the iBooks would not associate to the WPA2 networks without local admin login and manually choosing the SSID (and the password was still in the keychain and worked). I then brought some iBooks back to an area with just WPA (older firmware on older Airport could not do WPA2) and the iBooks were once again stranded. Leopard laptops moved seamlessly between the same APs.
I've also done some testing for rogue DHCP servers, but nothing was found, and I've not seen any wierd IPs coming up.
MrHoffman wrote:
Subnetting and vlans are options. If this is a decent-sized network, I'd definitely look to subnet it; you're already in line for subnetting now, what with what is probably mixed faculty and student traffic.
The reason that VLANs are on hold was that I told admin that with our limited wireless network (1 SSID, Airport not VLAN-aware), when they were not in an office with their laptops on ethernet, they'd only get Internet through the wireless (which would be on student/teacher VLAN), no access to admin servers or printers. I was surprised at the vociferous response.
MrHoffman wrote:
I'd probably toss a monitor onto different parts of the network - if you've not already tried this - and go hunting for "surprises". (If you're spec'ing out for bids on an upgrade, having packet-monitoring capabilities and rogue detection is really handy. That'll tell you if you have a rogue, or if DHCP traffic is pushing you over the edge.)
I have an old PC catching syslogs and it has Wireshark, but I haven't turned that on in a while. If I have time, I will see if I can capture anything. I did get bids on Cisco and Procurve wireless and network infrastructure upgrades last year, and pretty much got the 'no way, talk to the hand' response (and a few more Apple APs).
MrHoffman wrote:
Go talk to the finance folks and to the school board, and tell them that their servers and their network traffic are all exposed to the students. If they're not running encryption, they're toast. (And they're potentially toast even if they are.) That discussion both for reasons of budget, and to cover you, as this looks to be the textbook network configuration case that eventually "blows up" on the IT staff.
We're a medium-sized independent high school with a strapped budget. I have requested and explained everything, but it hasn't sunk in. Last year, I made everything work. This year, without all the special qos settings and tweaks to the switches I made last year to keep things mostly together, things are much more wonky (I stripped out all the qos settings over the summer while preparing for the VLANs, which I assumed was a no-brainer to happen. Unfortunately, I didn't document the settings before I cleared them, and I can't quite achieve the same balance this year). And, by the way, IT staff is pretty much me.