Windows and Linux networking bug

[iNo712]

Hey all,

I am having this weird 'bug' on my network. Here is the basic set-up:

Linux server running Redhat 6.2
-firewall
-dhcp server to internal lan
-dhcp client to cable modem

Clients:
-2 Win2k machines
-Win 98
-Win Me

The problem is very sporadic. Every now and then one of the Windows machines will develop what we call the '169 bug'. This is because all of the windows machines are using dhcp to obtain an ip address from the Linux server. When one of the machines gets the bug, it's ip address becomes 169.xxx.xxx.xxx and that particular machine cannot access the server or the internet. Oddly enough, we are still able to see them in network neighborhood. I have tried ipconfig /renew and winipcfg but it comes to no avail. The only resolution is to wait it out or to turn off all the windows machines, wait a few minutes and then start them up again. This leads me to believe that the problem is with the Windows machines, but I could be wrong.

My roomate and I have also checked the services running on the W2k machines to make sure dhcp server is disabled and we have not found anything wrong. Could there be other services running on the W2k boxes that would cause this bug? If so, any ideas???

I'm still new to Linux and networking so any help would definitely be appreciated. If you need more info on the setup, let me know. Thanks.

Phil

 

[Damaged]

Actually it's probably 169.254.xxx.xxx. That's what gets assigned when a client can't get it's IP address via DHCP. That's all that means.

Do you have enough IPs allocated for the number of machines that are requesting them? That's the first thing that comes to my mind, other than the machine can't reach the DHCP server.

 

[iNo712]

Yeah that's exactly it, 169.254.xxx.xxx. And I know that at least 10 IPs are available, yet I only have 5 machines on the network (including the server). Anything else I may be missing???

 

[Damaged]

What you'll want to do is run a packet sniffer on the Linux box on the interface that's serving the DHCP requests. tcpdump is freely available though quite verbose at times. If you're going to use it you should be on a console on that box, not telneted or ssh'd into the box.

You will want to use something along the lines of tcpdump -e -x -s 1500 udp port 67 to sniff out just the dhcp packets instead of everything. If someone is doing a release/renew you should see activity. If not you've most likely got some sort of physical network problem.

 

[iNo712]

Thanks for all the help Damaged, I'll try that as soon as possible.

Phil