DHCP request from nowhere

Hi,
In our DHCP server (French Windows 2k3 R2), we have records showing type
DHCP/BOOTP with a unique ID 31302e302e39302e31353xx.
Does someone know what could create entries like that ?
Every 10-15 minutes, a different record is created.
To be able to see those records, I have to go on my scope, right-click
Reconcile, Verify, Reconcile and then I can see the record.
Thanks for your help.

Hello Normand,

Any devide which is enabled to use DHCP, switches, printers, computers of
course, handheld if network ready etc.......

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hi,
> In our DHCP server (French Windows 2k3 R2), we have records showing
> type
> DHCP/BOOTP with a unique ID 31302e302e39302e31353xx.
> Does someone know what could create entries like that ?
> Every 10-15 minutes, a different record is created.
> To be able to see those records, I have to go on my scope, right-click
> Reconcile, Verify, Reconcile and then I can see the record.
> Thanks for your help.

"Normand" <(E-Mail Removed)> wrote in message news:(E-Mail Removed)...
> Hi,
> In our DHCP server (French Windows 2k3 R2), we have records showing type
> DHCP/BOOTP with a unique ID 31302e302e39302e31353xx.
> Does someone know what could create entries like that ?
> Every 10-15 minutes, a different record is created.
> To be able to see those records, I have to go on my scope, right-click
> Reconcile, Verify, Reconcile and then I can see the record.
> Thanks for your help.
>
>
>



Get the MAC address of the device or client, then log into your switch to determine what port it is on.

--
Ace

This posting is provided "AS-IS" with no warranties or guarantees and
confers no rights.

Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
Microsoft Certified Trainer
(E-Mail Removed)

For urgent issues, you may want to contact Microsoft PSS directly. Please
check http://support.microsoft.com for regional support phone numbers.

"Efficiency is doing things right; effectiveness is doing the right things." - Peter F. Drucker
http://twitter.com/acefekay

Hi Meinolf,
But one device can create multiple records in DHCP ?
The unique ID is supposed to be the MAC address of the device but in my
case, unique ID is 31302e302e39302e31353100, 31302e302e39302e31353200,
31302e302e39302e31353300, etc.
Thanks.


"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> a écrit dans le message de
groupe de discussion : (E-Mail Removed)...
> Hello Normand,
>
> Any devide which is enabled to use DHCP, switches, printers, computers of
> course, handheld if network ready etc.......
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Hi,
>> In our DHCP server (French Windows 2k3 R2), we have records showing
>> type
>> DHCP/BOOTP with a unique ID 31302e302e39302e31353xx.
>> Does someone know what could create entries like that ?
>> Every 10-15 minutes, a different record is created.
>> To be able to see those records, I have to go on my scope, right-click
>> Reconcile, Verify, Reconcile and then I can see the record.
>> Thanks for your help.
>
>

Hi Ace,
How can I find MAC address of that device ? MAC is supposed to be indicated
under Unique ID but what I have is 31302e302e39302e31353100,
31302e302e39302e31353200, 31302e302e39302e31353300, etc. for each record.
Thanks for any more help.


"Ace Fekay [Microsoft Certified Trainer]" <(E-Mail Removed)> a
écrit dans le message de groupe de discussion :
(E-Mail Removed)...
> "Normand" <(E-Mail Removed)> wrote in message
> news:(E-Mail Removed)...
>> Hi,
>> In our DHCP server (French Windows 2k3 R2), we have records showing type
>> DHCP/BOOTP with a unique ID 31302e302e39302e31353xx.
>> Does someone know what could create entries like that ?
>> Every 10-15 minutes, a different record is created.
>> To be able to see those records, I have to go on my scope, right-click
>> Reconcile, Verify, Reconcile and then I can see the record.
>> Thanks for your help.
>>
>>
>>
>
>
>
> Get the MAC address of the device or client, then log into your switch to
> determine what port it is on.
>
> --
> Ace
>
> This posting is provided "AS-IS" with no warranties or guarantees and
> confers no rights.
>
> Ace Fekay, MCSE 2003 & 2000, MCSA 2003 & 2000, MCSA Messaging, MCT
> Microsoft Certified Trainer
> (E-Mail Removed)
>
> For urgent issues, you may want to contact Microsoft PSS directly. Please
> check http://support.microsoft.com for regional support phone numbers.
>
> "Efficiency is doing things right; effectiveness is doing the right
> things." - Peter F. Drucker
> http://twitter.com/acefekay
>

Hello Normand,

Ping the ip address of that item and then run "arp -a" in a command prompt,
the list should also show the MAC for the ip address from that device.

Best regards

Meinolf Weber
Disclaimer: This posting is provided "AS IS" with no warranties, and confers
no rights.
** Please do NOT email, only reply to Newsgroups
** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm


> Hi Meinolf,
> But one device can create multiple records in DHCP ?
> The unique ID is supposed to be the MAC address of the device but in
> my
> case, unique ID is 31302e302e39302e31353100, 31302e302e39302e31353200,
> 31302e302e39302e31353300, etc.
> Thanks.
> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> a écrit dans le
> message de groupe de discussion :
> (E-Mail Removed)...
>
>> Hello Normand,
>>
>> Any devide which is enabled to use DHCP, switches, printers,
>> computers of course, handheld if network ready etc.......
>>
>> Best regards
>>
>> Meinolf Weber
>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>> confers no rights.
>> ** Please do NOT email, only reply to Newsgroups
>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>> Hi,
>>> In our DHCP server (French Windows 2k3 R2), we have records showing
>>> type
>>> DHCP/BOOTP with a unique ID 31302e302e39302e31353xx.
>>> Does someone know what could create entries like that ?
>>> Every 10-15 minutes, a different record is created.
>>> To be able to see those records, I have to go on my scope,
>>> right-click
>>> Reconcile, Verify, Reconcile and then I can see the record.
>>> Thanks for your help.

I did that and I can't ping the device with that Ip address.
Always receive a request time out.


"Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> a écrit dans le message de
groupe de discussion : (E-Mail Removed)...
> Hello Normand,
>
> Ping the ip address of that item and then run "arp -a" in a command
> prompt, the list should also show the MAC for the ip address from that
> device.
>
> Best regards
>
> Meinolf Weber
> Disclaimer: This posting is provided "AS IS" with no warranties, and
> confers no rights.
> ** Please do NOT email, only reply to Newsgroups
> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>
>> Hi Meinolf,
>> But one device can create multiple records in DHCP ?
>> The unique ID is supposed to be the MAC address of the device but in
>> my
>> case, unique ID is 31302e302e39302e31353100, 31302e302e39302e31353200,
>> 31302e302e39302e31353300, etc.
>> Thanks.
>> "Meinolf Weber [MVP-DS]" <meiweb(nospam)@gmx.de> a écrit dans le
>> message de groupe de discussion :
>> (E-Mail Removed)...
>>
>>> Hello Normand,
>>>
>>> Any devide which is enabled to use DHCP, switches, printers,
>>> computers of course, handheld if network ready etc.......
>>>
>>> Best regards
>>>
>>> Meinolf Weber
>>> Disclaimer: This posting is provided "AS IS" with no warranties, and
>>> confers no rights.
>>> ** Please do NOT email, only reply to Newsgroups
>>> ** HELP us help YOU!!! http://www.blakjak.demon.co.uk/mul_crss.htm
>>>> Hi,
>>>> In our DHCP server (French Windows 2k3 R2), we have records showing
>>>> type
>>>> DHCP/BOOTP with a unique ID 31302e302e39302e31353xx.
>>>> Does someone know what could create entries like that ?
>>>> Every 10-15 minutes, a different record is created.
>>>> To be able to see those records, I have to go on my scope,
>>>> right-click
>>>> Reconcile, Verify, Reconcile and then I can see the record.
>>>> Thanks for your help.
>
>

"Normand" <(E-Mail Removed)> wrote in message news:%(E-Mail Removed)...
> Hi Ace,
> How can I find MAC address of that device ? MAC is supposed to be indicated
> under Unique ID but what I have is 31302e302e39302e31353100,
> 31302e302e39302e31353200, 31302e302e39302e31353300, etc. for each record.
> Thanks for any more help.


Wow, that is odd. The uniqueID should be 12 characters. You are seeing a 24 bit MAC. Let's break it down.

For:
3130 2e30 2e39 302e 3135 3100
(put into calc as Hex, then changed from Qword to Dword) and got:

2E 39 30 2E 00

Do you see that MAC? If not, how about any of the following?

31 2e 30 31 31
or
30 30 39 2e 35 00


Ace

Hi Ace,

Nothing like that in my DHCP records.
Kind of bizarre thing.


"Ace Fekay [Microsoft Certified Trainer]" <(E-Mail Removed)> a
écrit dans le message de groupe de discussion :
(E-Mail Removed)...
> "Normand" <(E-Mail Removed)> wrote in message
> news:%(E-Mail Removed)...
>> Hi Ace,
>> How can I find MAC address of that device ? MAC is supposed to be
>> indicated
>> under Unique ID but what I have is 31302e302e39302e31353100,
>> 31302e302e39302e31353200, 31302e302e39302e31353300, etc. for each record.
>> Thanks for any more help.
>
>
> Wow, that is odd. The uniqueID should be 12 characters. You are seeing a
> 24 bit MAC. Let's break it down.
>
> For:
> 3130 2e30 2e39 302e 3135 3100
> (put into calc as Hex, then changed from Qword to Dword) and got:
>
> 2E 39 30 2E 00
>
> Do you see that MAC? If not, how about any of the following?
>
> 31 2e 30 31 31
> or
> 30 30 39 2e 35 00
>
>
> Ace
>
>

"Normand" <(E-Mail Removed)> wrote in message news:(E-Mail Removed)...
> Hi Ace,
>
> Nothing like that in my DHCP records.
> Kind of bizarre thing.

No, not in DHCP records, I mean after breaking it down as I suggested (and that was just a stab at it), to look for that number as a possible MAC in the switche's ARP or MAC table.

Ace