How reliable is the ipconfig /all information?

[Howell]

If the report says that a particular DHCP server was used, is that a guaranteed?

From my understanding of the DHCP hanshake process I believe it to be true but I wanted to double check.

 

[ddrueding]

I don't know how it could be wrong. There would have to be some sort of corruption or crazy config of the DHCP server itself. Does the DHCP server have multiple IP addresses?

 

[Mercutio]

If you're dealing with non-routable IPs, it's entirely possible that the machine that reports itself as 192.168.1.1 isn't the machine you think it is. I've had to deal with weirdness of like employees bringing in their own Wireless routers. That can cause all kinds of weirdness.

 

[ddrueding]

I've had to deal with weirdness of like employees bringing in their own Wireless routers. That can cause all kinds of weirdness.

This is very possible. The best way I know of to check is to disable your DHCP server and attempt to renew. It is not fun trying to physically locate the device.

 

[Mercutio]

Yes. I've wanted to strangle people a couple of times over that.

 

[Howell]

If you're dealing with non-routable IPs, it's entirely possible that the machine that reports itself as 192.168.1.1 isn't the machine you think it is. I've had to deal with weirdness of like employees bringing in their own Wireless routers. That can cause all kinds of weirdness.

I'm not sure if I understand your scenario. You are talking about two devices configured for 192.168.1.1, right?

 

[Howell]

Let me give you the full scenario for your amusement.

A workstation release/renews its IP and obtains 71.83. /all tells me that it used DHCP server 71.14 and along with all the other information is using 71.9 for DNS. I repeatedly /all and somewhere between 20 and 25 seconds after the lease renew /all reports that it is now using 1.1 for DNS. Switching all by itself.

I can repeat the procedure and get the same results. So, one conseptual possibility was two DHCP servers running on that one server. The other is that is a completely workstation issue.

I scanned the workstation for virii and malware. Nadda. I rebuilt the workstation IP stack with netsh.

I moved the DHCP server service to another box and the problem remains with the slight difference of the correct recognition of the new DHCP server address.

I ended up hard coding the DNS address because the machine will be replaced next year. And I would be totally fine with that except that I get a report that a plotter had the same difficulty a few months ago. Oy vey.

 

[sdbardwick]

I had a similar problem once upon a time. Once, someone needed more ethernet ports in his office. He brought in a spare router with 4 port switch, and never turned off the router's DHCP server. Took me 2 hours on a Sunday to track it down by disconnecting cables and pinging the 192.168.1.1 address. His defense was "But I was only using the switch ports, not the WAN port!"

 

[blakerwry]

That's one of the reasons I prefer managed switches - port security and access lists prevent the majority of problems. It becomes incredibly easy to track down any remaining problems when you can see what machines are attached to each port.

Now if all of my switches supported 802.1x I'd be in heaven.

 

[Mercutio]

For the size of the offices I'm normally dealing with, port authentication isn't even an available option for the equipment.

 

[blakerwry]

You can get reconditioned Cisco 2950 10/100 (gbit uplink) switches for under $200. Literally pennies on the dollar compared to new.

It's not unless you need gigabit to the desktop where you have to worry about price on a managed switch... If you need full gbit, a 2960G will likely set you back ~ $1500. If you've already made a business case for gigabit to the desktop, then I don't see that being an unreasonable price.

And if you have a business case for 100Mbit+ to the internet a cisco 45xx isn't bad. One device for ~ $2000 that can do all your switching and routing at gigabit speeds.