My network was working just fine and I broke it.

There is a Cisco 1711 router which was configured to hand out DHCP leases to the client PCs. I have a domain controller (Server 2008) on the same network that I wanted to take over the DHCP role. I added the DHCP role to the server, configured the scope, and activated it. Then I turned off DHCP on the Cisco 1711 by running no service dhcp in config mode.

I tried to renew the IP address on a client, and it failed. I ran Wireshark on the server, and it sees the three DHCP Requests that the client sends before reporting a failure. Absolutely no DHCP packets are sent in response. In the DHCP mmc, Statistics tells the same story:

Discovers        0
Offers           0
Requests         6
Acks             0
Nacks            0
Declines         0
Releases         0
Total Scopes     1
Total Addresses  50

The DHCP service is running and authorized. I checked C:\Windows\System32\dhcp\DhcpSrvLog-Mon.log to confirm this.


I've triple-checked my scope configuration, it's definitely correct. The server is not multi-homed. I disabled and re-enabled the DHCPv4 bindings on the single network adapter. I even restarted the server. I can't think of any reason the server would just ignore DHCP requests.

It gets weirder. I decided to give up on using the server and return to using the Cisco router as the DHCP server. I ran service dhcp in configuration mode to resume the DHCP service. I tried renewing the DHCP lease on the client PC again, and it STILL failed. Then I turned on debugging (debug ip dhcp server events and debug ip dhcp server packet) and tried renewing DHCP on the client again. There was absolutely no output to my SSH session with the router! It's as if the packets are disappearing completely.

The network is simple and flat. All of the devices (PCs, server, router) are connected to the same Layer 2 gigabit switch.

  • How about the Event log on the server, anything there?
    – joeqwerty
    Jan 24, 2011 at 22:10
  • Only events related to DHCP are 10020 (dynamic IPv6, which I've since disabled) and 1044 (DHCP is authorized to start, servicing clients now.)
    – Nic
    Jan 24, 2011 at 22:14
  • 1
    +1 for honesty "My network was working just fine and I broke it." Jan 24, 2011 at 22:29

1 Answer 1


You haven't actually verified that the Windows Server machine is receiving the DHCPDISCOVER requests. I'd throw a sniffer on it (either Microsoft Network Monitor or Wireshark) and verify that the packets really are making it to the server computer.

Are you certain your Ethernet switch doesn't have any "fancy" DHCP-related functionality that might be getting in the way? Your disappearing DHCP packets that you describe toward the end of your posting make me wonder if the switch is "swallowing" them somehow.

Edit: Zow-- I'm a moron! Talk about not being able to read.

Here's a silly question: Is the server computer's NIC configured with an IP address inside the subnet that the DHCP scope encompasses? If not, you'll need a DHCP relay agent (which could be running on your router) to forward the request to the server because, even though it's receiving the request at layer 2, if the server doesn't have a NIC in the subnet with the scope (or if the request doesn't come from a relay agent in the subnet that corresponds to the scope) the server won't answer.

If they're just RFC1918 IP addresses, go ahead and edit your question to include the server computer's IP address and the DHCP scope metes and bounds.

  • I did run Wireshark on the server and the server is definitely receiving 3 "DHCP Request" packets but not "DHCP Discover".
    – Nic
    Jan 24, 2011 at 22:17
  • @Evan: I think you mean "in the same subnet" not "in the same scope" in the first sentence of your edit.
    – joeqwerty
    Jan 24, 2011 at 22:23
  • 1
    @joeqwerty: This shows why I shouldn't sneak over to Server Fault while waiting for a reboot to answer a couple of questions quickly... >smile< Jan 24, 2011 at 22:24
  • Speaking of "I'm a moron" ... I had configured the address pool range to be -, but the server address was I expanded the address pool and it works now.
    – Nic
    Jan 24, 2011 at 22:25
  • 1
    What subnet mask is in use because the original range looks fine to me for a /24 subnet.
    – joeqwerty
    Jan 24, 2011 at 22:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.