[net_user]

hope this is in the right section.
i'm using wireshark to analyze my network performance.
i'm seeing some dhcp discover packets being sent out, from multiple mac address's
all computers on the network have a static ip address, with static dns settings.
i've looked at the packets and see that they are being sent out by my computers. (no new or unauthorized devices)


any clue why a pc with static ip settings would send out a dhcp dicovery?
thanks

[VideoRipper]

Don't have a real answer (or a clue), but I can imagine that Microsoft (in their wisdom) use similar
packets when "Client for Microsoft Networks" and/or "File and printer sharing"-drivers are installed?

[CoffeeFiend]

I don't have a direct answer, but it would be extremely helpful to have more details to figure it out. If you take note of which mac addresses the packets are sent from and also manage to find the culprit, then you can have a deeper look at its settings, and if it's specific to a certain OS. Mind you, I don't see DHCP discover being much of an issue, it's not like your clients are sending out DHCP requests. It might actually just be network discovery.

[MrJinje]

Coffee might be on to something with the Network Discovery. That seems plausible in M$ realm.

But if it is only happening during reboots (you never specified when it is happening), then maybe it's just a PXE enabled NIC sending a few DISC packets during BIOS stage.... No harm if that is the case.

Like they said, I wouldn't be worried until you see DHCPOFFER and DHCPACK packets.

[net_user]

i can start at any time during the day, and let wireshark run for a few min,
and see random computers on the network with the dhcp discovery packets being broadcast out ever so often.
i can see the mac address in the packet, and trace it to the computer.

I've even actually went to the computer and looked at the settings.
nothing is set to dhcp
just stumped on this.

edit*
forgot to mention all computers are xp pro sp3

This post has been edited by net_user: 16 March 2010 - 08:09 AM

[GrofLuigi]

DHCPINFORM and/or (looking for) WPAD?

Just guessing...  

GL