Win7 dhcp client wierd arp cache issue

Hi all,
I have this pc when connected to my switch it suppose to grad a dhcp ip, but it wasn't able to and i can see the ip 169.x.x.x(APIPA). Its set to dhcp. I noticed on my switch whenever the pc is connected, my switch gets a arp for 1.1.1.1 aaaa.aaaa.aaaa(my
pc mac address). If i remove the pc cable connection from the switch, after a while the arp for 1.1.1.1 would time out. I use a work around by changing the mac address of my pc and it would then be able to get a dhcp ip and work fine. There is no static arp
set on my switch. Pls advise. Thks in adance.

Hi,
Might we consider to make use of network monitor to take a look at the traffics for the 1.1.1.1 address?
How to use Network Monitor to capture network traffic
Download link here:
Microsoft Network Monitor 3.4
Best regards
Michael Shao
TechNet Community Support

Similar Messages

Win7 dhcp client: sending options

I am trying to change dhcp option 60 and 43 on my Windows 7 Cleint PC.
The standard option 60 - vendor class identifier is set to "MSFT 5.0" and I would like to change it to a different value of "Siemens". Similarly I want to send a Vendor Specific ID using option 43.
I have tried to add:
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DHCP\Parameters\Options\DhcpSendOptions
"60"=hex:3c,07,53,69,65,6d,65,6e,73
but try as I will, it will not send anything modified in the DHCP client request to the server.
Do I need to put the registry entry somewhere else or in a different format?
Thanks.

Hi,
After research, I found this registry key was supported by Windows CE and may not be supported in Windows 7. Otherwise, I have not found any documents that mentioned this.
Juke Chou
TechNet Community Support

E4200 IPv6 Causes Win7 DHCP Client Crash

When I enable IPv6 on my E4200, the Windows 7 DHCP client crashes. It also seems to crash the audio service, the event logger and a few other windows services. Please let me know what extra information you need.
Thanks in advance.

Check the even viewer for details.
Generally, a crash of windows or windows services is a problem of windows. It must not crash. You may have to repair your windows installation or the network stack. Check a microsoft forum for instructions.

Why doesn't my airport express router issue proper DNS server address to DHCP clients?

I have an Airport express router (version 7.6.4). It was configured to connect to internet via a cable modem, acting as a router with NAT. This means it obtians WAN address from cable modem, and in LAN it assumes IP address 10.0.1.1 as a gateway, and issue IP address to my 4-5 wireless clients (MBA, iPads, PCs) vi DHCP.
However I recently encounter an issue, that the router no longer issues DNS server address obtained from Cable Modem(206.x.x.x) but instead tell every DHCP client to use router ip address (10.0.1.1) as DNS server. I was pretty sure before Dec 2013 it is issueing (206.x.x.x) to all DHCP clients.
Apparently now the Airport express is acting as a DNS server or as a DNS cache. This works sporadically and very often result in long DNS look up or DNS look up failure.
Is this a bug or is it supposed to do so? Any configuration can turn it off so Airport express will issue Cable modem obtained DNS server to DHCP clients?
My network otherwise works fine. for some of the Clients (e.g. one MBA) I configured DNS for it mannually and it's internet is working very smoothly.

But this will be a problem for my ipad and iphone that uses wifi.
These devices either allow full DHCP. If you need to mannually enter DNS server, you will need to turn entire IP configuration to mannual and that will be a problem for me.

Directory Caching issue with Cisco Jabber client for Windows

Hi ,
I am facing cache issue with Cisco Jabber client for Windows. If I do any change related to modification or deletion of contacts in Active Directory/ Callmanager, it does not reflect in the Jabber. Because jabber takes the contacts from the locally stored cache file in the Windows system.
Every time I have to remove the cache file to overcome this issue, practically it's not possible to do the same with all the Widows users. As, if any employee leaves the company and still I can see his contact appears in the "Cisco Jabber client". I have not seen this issue with Android/Apple iOS.
Is there any automated way to remove the cache file?
Here is the detail of CUCM,Presence and Jabber.
CUCM version: 9.1.x
Presence : 9.1.X
Jabber : 10.5 and 10.6

Hello
On our environment we had to install a dedicated Microsoft Certificate Authority "just for Cisco Jabber usage" to house the
Network Device Enrollment Service.
Our certificate for the CUPS were generated on this Certification Authority too.
I discussed this certificate matter with my colleagues this afternoon and nobody seems to remember how these certificates were deployed into the
Enterprise Trust store for the users.
But I think they asked all 400 users to accept the 3 certificates by answering "yes" to the popup instead of using a script deployed by GPO...
I wish you success with that deployment and really hope you have a technical partner that *Knows* this subject.
Our partner left us alone with that unfortunately.
Florent
EDIT: If the "Certutil script method" works, please let me know. This could be useful in our own deployment.

WRT400N - issues with brief disconnects and DHCP client table

Hello,
I recently bought a WRT400N to replace my (seemingly) dead WRT54GS. It worked great out of the box, and setup was quick and intuitive, just like my previous router. It came with firmware version 1.0.10 B19.
I'm having two problems. First, while playing some online games, I'm getting brief disconnects every 2-3 minutes. It's usually just enough to make the screen studder (I'll get a "Connection Interrupted" message for a split second), and then it goes away. It's happening often enough where it's causing issues, though. My computer is connected directly to the router via CAT 6, and the only component that has changed since the issue started is the router itself. To add confusion to the problem, when I do a tracert to something like Google, most of the hops come back fine, but I'm noticing it takes 4-5 seconds before it lists an IP address for any given hop, UNLESS a domain name is specified. The actual columns with the latency numbers are filled in quickly, but the IP address itself at the end of the line hangs for a minute. For example, the final hop, "12 22 ms 24 ms 23 ms od-in-f104.google.com [64.233.161.104]" is displayed instantly, but any hops along the way that just show an IP address, such as "11 27 ms 26 ms 25 ms 216.239.48.190" have a long pause before the IP address (bold) is displayed. Normally I would think it's a problem with the routers along the way, but the delay even happens before it displays the hop to my router's IP - 192.168.1.1. Very weird. I wasn't sure if these issues were related.
The second problem is the DHCP client table in the router's web administration utility. On my old router, the DHCP client table always displayed all computers that were connected to the router (DHCP set to auto). With the WRT400N, I'm noticing only a few of the machines are actually showing up. They're all being assigned IPs without any issues, and they're all able to connect; they're just not showing up in the table. I often check the client table to see who's connected or grab a MAC address when I need to mess with QoS or access restriction, so the fact that some clients are missing is a bit annoying. The old router didn't have this issue.
Thank you.

As you are facing this problem with the Wired Computer, then i think you need to change some settings on your Router. Once you login to the Router GUI, below the Setup tab you will find MTU, which will be set to AUTO,So change it to Manual and change the Size from 1500 to 1365 and click on Save Settings. Once you are done, now try to play the Games and check if you are facing the same problem or not.
If still you face the same problem, then i think you need to Re-Flash the firmware on you Router.. Go to website linksysbycisco.com/downloads .........insert model no of your router in serach tab......select proper version of your router........download the firmware file......save that file on desktop..
Follow these steps to upgrade the firmware on the device : -
Open an Internet Explorer browser page on a computer hard wired to the router...
In the address bar type - 192.168.1.1...Leave the Username blank & in Password use admin in lower case...
Click on the 'Administration' tab- Then click on the 'Firmware Upgrade' sub tab- Here click on 'Browse' and browse the .bin firmware file and click on "Upgrade"...
Wait for few seconds until it shows that "Upgrade is successful" After the firmware upgrade, click on "Reboot" and you will be returned back to the same page OR it will say "Page cannot be displayed".
Now reset your router :
Press and hold the reset button for 30 seconds...Release the reset button...Unplug the power cable from your router, wait for 30 seconds and re-connect the power cable...Now re-configure your router...

Csm arp cache timeout issues

Hello all.
The arp cache timeout of the csm is normally 4 hours.
Now if we want to replace one of our servers we would need to wait 4 hours before the new servers mac address is learned if we keep the old ip-address.
I know we can manually flush one entry from the arp cache but is there a way for the csm to find out sooner if the mac address has changed?
I also know we can make the time shorter before the cache expires but what would be the consequences if we would put the timer to lets say 1000 seconds?
Would we then be flooding our network with arp requests all the time?
Finally I would expect that if an icmp request would fail because of the change of mac addres the csm would make an arp request to find out who has the ip I am trying to ping.
What is the procedure if the icmp request would fail?
Thank you.
Daniel Levi

I would not suggest using the manual method, since it is time consuming and also there is a good chance that the new ARP request may load the CSM. I would suggest that you wait for the arp cache timeout.

ARP Cache Poison behavior by Apple TV

Norton Anti-Virus reports blocking an ARP Cache Poison attack against my home network. The reported source of the attack is the MAC number of the Apple TV on the network.
Whether Norton is "reliable" is apparently contentious in the support community. Several authors suggest, with authority, disabling Norton or the particular attack profile.
Whether that makes sense depends on what the Apple TV is innocently doing to be profiled as a network attack.
Even when supposedly "asleep" the Apple TV is doing something that meets the profile of an ARP Cache Poison attack. It did it every 30 minutes today, nine times yesterday, about 30 times day before and etc.
And if it is a design feature of the device, why is the device still performing despite having the activity continously blocked? What is the purpose of this attack-like activity, assuming it is not an attack? If it is an attack, how does one erase the programming initiating the attacks and still have an Apple TV?

Short answer: it is a false positive. I don't know exactly what causes it but I would guess Apple's Bonjour protocol, which is why you see something every 30 minutes. That's just a blind guess, but seems to fit.
Realize that a report of ARP poisoning wouldn't be likely on a private LAN, unless you got infected somehow. No known malware like this for iOS devices (and much harder to insert one on AppleTV versus an iPhone or iPad.) There are legitimate cases where ARP spoofing is used. And even Cisco has instances where they say to ignore that warning:
CSCsm25943—The meaning of the following error message on the controller is not clear. This message does not necessarily imply that any actual "ARP poisoning" is occurring. Rather, this message appears when a WLAN is configured for DHCP Required and a client (after associating to this WLAN) transmits an ARP message without first using DHCP. The client is unable to send or receive any data traffic until it performs DHCP through the controller.
DTL-1-ARP_POISON_DETECTED: STA [00:01:02:0e:54:c4, 0.0.0.0] ARP (op 1) received with
invalid SPA 192.168.1.152/TPA 192.168.0.206
Workaround: Perform the following steps:
• Verify that the client eventually does perform DHCP without undergoing an unacceptable outage. If the outage before performing DHCP is acceptable, then you can ignore this message.
I'm not saying that Norton's message is the same as Cisco's. Just that Cisco states that the meaning of why the message appears is not clear and sometimes is acceptable. And Cisco is the world leader in networking technology so if they don't always know why you get an ARP poisoning warning....
I won't go into the politics of "Norton bad" or whatever, but based on my experience (bias) with Norton in it's various forms for over 10 years, IMHO you can ignore this. Hopefully you can configure Norton to selectively ignore this. If not, you may have to use a different security program. Me personally, I do not recommend any "security suites" because they cause exactly this kind of additional headache. Just a "plain" antivirus program. Windows has a built-in firewall and most people will be using a hardware firewall at the office or home so the firewall in the "security suite" is extraneous.

Cisco ASA 5505 and DHCP Client Problems

Hi, i have a problem. I've connected my ASA appliance to an ADSL modem, and i dont get an DHCP address on the outside interface (e0/0). I use the asa-722-19.bin firmware.
I turned on the debugging for the DHCP client and could see that the ASA device was sending out broadcasts but a reply never came. Instead I connected the device to my internal network where the ASA got an address instantly.
I read somewhere that if I was to use ?ip address dhcp client-id fastethernet 0″, then I got an address from the ISP.
I tried looking for a similar command on the ASA5505 but I couldn?t find anything. I did however find a page on the Cisco site confirming my suspicions. It said some ISP?s require the client-id field of the DHCPDISCOVER request to be filled.
I've also read that this issue has beed fixed since a few weeks, now they have released version 7.2(2).22 where you can define ?dhcp-client client-id interface outside? in global configuration mode. Im running 7.2(2).19 and i cannot find any command like that in my appaiance. How do i fix my problem ? Or how do i get about recieving the 7.2(2).22 firmware update.
Regards !
Leif

Hi again! I thought I should share the solution that worked for me. I use software version 7.2(2) on this device. ASDM 5.2(2). In ASDM open configuration / Interfaces. Click in outside (my case 0/0) and press Edit. Then open the tab Advanced and set the correct Active Mac address. Fore some reason its empty by default and the ISP/modem don't like that. You will find the correct MAC address under the help menu / "About ASA". Im sure there is some another way to do this but this is a simple "how-to" that works with Swedens biggest ISP and their standard DSL modem.
When I used a Linksys DSL modem in bridge mode without the MAC address set I got an inside IP adress (192.168.x.x) from the modem to the ASA. After setting the MAC address I just had to do a renew and got the outside address right away. /Bjorn
(future users searchwords: no ip from isp, ASA 5505 and cable modem).

E4200v2 - DHCP client list NEVER displays

As the most expensive and hyped "consumer router" at the local big-box stores, and after already returning a Netgear N600 that appeared to be defective, I had high hopes that this router would work properly and I could stop fooling with router settings and move on to real work. And I'll acknowledge that for a lot of folks this router will probably be fine. I didn't do any speed measurements or methodical testing, but it seems pretty fast and using it for more than three weeks it seemed reliable. However, it had several issues that were maddening and ultimately for me, unacceptable. Summarized as follows:
> The DHCP client list NEVER displays all the clients connected on my network, no matter how many times I look. These clients are actively transferring data, and I can download free programs from the web that report all clients reliably. Why is this so difficult??
> The logging feature is ridiculous - it often didn't log events that I knew had occurred, and even when they were shown, you would only see an entry if you checked the log very quickly after the event (some sort of "auto-flush" function that makes the whole feature pretty useless).
> The previous issues are annoying - but this was the deal-breaker. I could not connect to an OpenVPN device on my network through this router. I could connect to the device locally, I could connect to other devices remotely through other forwarded ports, and I could see in the log (if I looked quickly enough) that the router was seeing the connection attempt to the OpenVPN device, but it was getting blocked. Many hours searching forums and experimenting with router settings / firmware updates did not help.
> In the pursuit of resolving the third issue, and with very low expectations, I contacted Linksys tech support. This proved to be a complete waste of time. After working through the front-line guy who only knew how to look through the User's Guide, I was connected to another person who was even more clueless and was almost robotic in his hard-coded sequence of attempts to guide me through silly procedures that had absolutely nothing to do with my problem. After again asking if I could speak to someone that might actually understand the issue I was put on hold for more than 20 minutes, at which point the call was disconnected (I think this means they hung up on me).
So once again I'm returning an expensive router that doesn't work properly and will be trying something else. It shouldn't be this difficult.

With reference to your post I would like to know that does all the client devices on your network runs on DHCP or some of them have static IP address as well? The devices which are running on static IP address will not be displayed in the DHCP client table.
Regarding the logs that are not being created on the router for any event that takes place could be because of the reason that you might be using another router or a gateway before your linksys router.
As far as your VPN issue is concerned please try to disable the firewall of the router and then try to connect to the open VPN device because this router acts like a VPN passthrough. Click on the following link to know how to disable the router's firewall http://www6.nohold.net/Cisco2/ukp.aspx?vw=1&docid=87795adab27b4bd7a432e03be4e28e8d_17347.xml&pid=80&...

Have to regularly restart DHCP Client - HP Pavilion 500-205 DT - Windows 7

HP Pavilion 500-205 DT - Windows 7 Home Premium 64-bit SP1
Realtek PCIe GBE Family Controller - Driver 7.67.1226.2012
Bought 3 identical machines for our childcare center. Set them up the same. All work fine except ONE of them becomes inaccessible periodically (daily more-or-less) to the other Windows computers on our little peer-to-peer LAN. You can see it, but cannot access any shared folder. There is NO problem accessing the OTHER computers on the LAN from this one. All 3 machines have the same sharing profile, workgroup, permissions, AV, firewall settings, everything. I realized restarting the computer in question solved the problem immediately but temporarily. I narrowed it down to restarting the DHCP Client service. Do that, everything works fine immediately but temporarily.
Things I tried:
Calling HP support - not helpful at all. It is under warranty.
Disabled IPv6
Disabled wireless
Disabled power-saving shutoff of network adapter
Setting DHCP CLIENT recovery to:
First Failure = Restart the the Service
Second Failure = Restart the the Service
Subsequent Failures = Restart the the Service
Reset Fail count After = 120
Restart Service after = 0
But again, this isn't happening to the other machines with default settings. Nothing works except restarting the DHCP Client service. The loss of access happens with or without someone logged or using it. It has happened since it was first set up.
I don't know if the HP warranty covers factory-loaded OS. I don't want to restore the thing and start over. I am not an IT professional, just the guy in the office who does these things, but it seems like the network adapter could be defective. I don't know if I can convince a first-level phone support person to have me bring the machine to an authorized service place.
Any help greatly appreciated,
Larry
This question was solved.
View Solution.

You're very welcome.
I would tend to agree, but I wanted to offer you that driver as a last resort.
This is a consumer to consumer forum. I don't work for HP, and if you suspect it is a hardware issue, you will need to contact HP technical support and submit a support case under the warranty.
The warranty covers hardware, and support for the HP software and operating system installed (as long as it is the original factory image that came with the PC and not an operating system you installed).

Using Extreme in Bridge mode, can't see the DHCP clients if the D-Link router

I have an Airport Extreme attached to my DLink modem/router. I have configured the Airport Extreme in Bridge mode, and I was expecting all clients to show up in my D-Link router. Although the configuration works most of the time, I have been experience a few issues:
1. From time to time, computers attached (both Windows and/or Mac) complain about an IP address conflict. I can ignore the error and it works fine.
2. From time to time, I loose Internet connectivity, and I need to disconnect my computer and reconnect again to solve the issue. This is not necessarily linked to symptom #1
3. On my D-Link router/modem (which I only use to connect my Airport to my ISP), if I check the DHCP clients, I can see the Airport router connected and *some* of the wireless clients that connect through the Airport. The list changes quite randomly, and at times, I see the airport appearing twice with different IP addresses.
Any help configuring it "right" will be appreciated!
Alain

When the AirPort Extreme is in bridge mode, the AirPort Extreme is simply passing through the DHCP settings and services that are handled by the D-Link modem/router.
In other words, the D-Link device is in total charge of the DHCP services for devices on the network.
You might want to check with D-Link support to see if they have any recommended practices for configuing the modem/router when another router....the AirPort Extreme in this case....is being used in bridge mode on the network

WRT54G v7 WAN DHCP client problem

I've recently started having a strange problem with my WRT54G. Internet access is via a Cable modem and has been working fine for months, and the cable modem works fine so I suspect the problem is with the router. However the router is also working, mostly, so I figured I'd see if anyone here has any suggestions. Here are the details of the problem:
The router WAN configuration was set to DHCP.
It used to happily pick up a new IP address from the cable modem whenever necessary.
One night the router stopped picking up an IP on the WAN side. (nothing was changed. I'm the only one in the house who goes anywhere near the router)
Connecting the modem directly to a PC works fine (suggesting the modem's DHCP server is fine).
Copying the WAN IP config from the PC to the router, as a Static IP, also allows it to work when the modem is plugged back into the router and the router to a PC (which is how it's setup now, but it's a pain to have to mess with the physical connections and manually reconfigure the router every time the modem drops a connection (which is another issue, but not one for this forum...)).
So both the modem and the router seem to work except for the router's DHCP client. It works fine as a DHCP server for the LAN.
The firmware was already upgraded (and working), I've followed the standard power-cycle procedure, I've released and renewed the IP via the Status tab in the web interface, and I've tried resetting the router using both the button on the unit and via the web interface to revert to factory defaults.
Any suggestions?
Solved!
Go to Solution.

I also had this problem which occurred after >2 years of the router working fine. After changing MTU to 1300, cloning the PC MAC address, and power cycling the router and modem fixed the problem. But I was curious to see which change did the trick, so I changed both back to the default (MTU = auto and not cloning the MAC address) and it worked fine! I think the router problem is intermittant and may appear to be fixed by changing setting, but I fully expect it to reoccur.

DHCP client fails to get an valid IP address from DHCP server. windows 8.1

I have a win 8.1 Pro 64 bit pc in my office .I'm trying to connect it to my wireless cisco router with either wireless or hardwired connection but I get an error in the event viewer with discription DHCP error 1007. and Ip address showing
169.254.93.17 but our dhcp range is 192.168.1.x
Log Name: Microsoft-Windows-Dhcp-
Source: Microsoft-Windows-Dhcp-Client
Date: 23/Jun/2014 12:03:21 PM
Event ID: 1001
Task Category: Address Configuration State Event
Level: Error
Keywords: (1)
User: LOCAL SERVICE
Computer: sanddeplap.vts.com
Description:
Your computer was not assigned an address from the network (by the DHCP Server) for the Network Card with network address 0xF4B7E22D8721. The following error occurred: 0x79. Your computer will continue to try and obtain an address on its
own from the network address (DHCP) server.
Event Xml:
<Event xmlns="http://schemas.">
<System>
<Provider Name="Microsoft-Windows-Dhcp-
<EventID>1001</EventID>
<Version>0</Version>
<Level>2</Level>
<Task>3</Task>
<Opcode>75</Opcode>
<Keywords>0x4000000000000001</
<TimeCreated SystemTime="2014-06-23T08:03:
<EventRecordID>363</
<Correlation />
<Execution ProcessID="988" ThreadID="7932" />
<Channel>Microsoft-Windows-
<Computer>sanddeplap.vts.com</
<Security UserID="S-1-5-19" />
</System>
<EventData>
<Data Name="HWLength">6</Data>
<Data Name="HWAddress">F4B7E22D8721<
<Data Name="StatusCode">121</Data>
</EventData>
</Event>
I tried to track issue with microsoft network monitor I'm attaching the capture file also please help me to sort out this issue
capture report https://onedrive.live.com/redir?resid=AFE3D0245A92F6F8%21183

The issue is that your machine is not being assigned an IP address / was unable to reach the DHCP server to receive one. The 169.254.x.x IP your machine is showing isn't assigned from DHCP, it's assigned by the local machine and is referred to as an APIPA
address.
So something is preventing your machine from reaching your DHCP server, which could one of a number of things. In the first instance I'd suggest having a look at
http://epan36.blogspot.co.uk/2012/09/eventid-1001-dhcp-your-computer-was-not.html which lists several of things that could cause this error and things you can try in order to resolve it.
If none of those work, can you confirm whether you have any other machines connecting via the same method on the network, which might indicate whether this is an issue at the machine end or somewhere between the machine and DHCP server?

Clear arp-cache to ping

I have an SMS server on my network that is unreachable from vlans other that its own. This happened after we pushed out tumbleweed via SMS. Now, in order to ping the server I must issue a clear arp-cache in the core switch, this only last for about 1 min and then the SMS server is unreachable again. Any help would be great.

Thanks Dabels,
I have had this problem as well, it turned out to be a pix.
Proxy-arp is enabled by default on all interfaces and its not apparent in the config when its on or off. Its configured as a sysopt and therefore, it often gets overlooked.
Agree with everything you say, check the mac in the arp table of the server when your pings are failing, then trace the MAC you find there which corresponds to the ip address of the router.
Or check the arp entry in the router (again when its failing) and verify the MAC is the SMS server, it may just turn out to be a router or a pix or even....another server which is routing between a pair of NIC's, such as a unix box or a windows server.
Let us know how you get on.
Cheers
Shaun

Win7 dhcp client wierd arp cache issue

Similar Messages

Maybe you are looking for