Understanding the Root Causes
The most common reason for incorrect IP assignment is a conflict between two active DHCP servers on the same broadcast domain. This often happens when a rogue device, such as a consumer-grade router, is plugged into an enterprise network port. Alternatively, the issue may lie within the configuration of your primary DHCP server itself. If the server has multiple scopes configured for different subnets but the interface receiving the request is not bound to the correct scope, it may hand out addresses from the wrong range.
VLAN misconfigurations are another frequent culprit. If a switch port is assigned to the wrong VLAN, or if the trunk ports carrying tagged traffic are not properly configured, DHCP requests may be forwarded to the wrong subnet. In environments with multiple sites, DHCP Relay Agents (IP Helper) might be pointing to an outdated server IP or a server that no longer holds the correct scope for that specific VLAN. Additionally, DNS integration issues can sometimes mask the symptom, making it appear as though the IP is wrong when the hostname resolution is simply failing due to a stale record.
Step 1: Verify Scope Configuration and Conflicts
Begin by logging into your DHCP management console. Check if there are any overlapping IP ranges defined in different scopes. For example, if you have a scope for 192.168.1.0/24 and another for 192.168.2.0/24, ensure they do not share any excluded or reserved ranges. Look for "Conflict" states in the DHCP console, which indicate the server has detected an IP address currently in use on the network, likely causing it to skip those addresses or assign alternatives incorrectly.
If you suspect a rogue DHCP server, you can use command-line tools to identify it. Run ipconfig /release followed by ipconfig /renew on a client machine and observe the output. If the lease comes from an unexpected source, check your switch logs or use packet capture tools like Wireshark to filter for DHCP Offer packets. Identify the MAC address of the device sending the offer; this will help you locate the unauthorized server physically on the network.
Step 2: Check VLAN and Relay Agent Settings
Ensure that the VLAN ID associated with the client's access port matches the VLAN configured in your DHCP server's scope options. If you are using DHCP Relay Agents, verify that the ip helper-address command on the Layer 3 switch points to the correct DHCP server IP. A common error is configuring the helper address to point to a secondary server that does not have the necessary scope for that VLAN.
Review the switch port configuration to confirm it is not dynamically changing VLANs or experiencing spanning-tree topology changes that might temporarily isolate the client. If the network uses dynamic VLAN assignment based on user credentials (like 802.1X), ensure the authentication server is correctly mapping users to the intended VLAN before the DHCP request is sent.
Step 3: Clear Stale Leases and Client Caches
Sometimes the problem is not with the server but with the client holding onto an old, invalid lease. On Windows clients, open a command prompt and run ipconfig /flushdns to clear cached DNS records, then use ipconfig /release and ipconfig /renew to force a fresh DHCP negotiation. For Linux clients, restart the network service or use dhclient -r followed by dhclient.
On the DHCP server side, you can delete stale reservations or expired leases that are cluttering the database. Navigate to the Address Leases section in your DHCP console and remove entries that show as "Expired" or "Reserved" but are no longer in use. This prevents the server from trying to reassign these addresses incorrectly during high-traffic periods.
Step 4: Validate DNS Integration
Incorrect IP assignments can sometimes be confused with DNS failures. If the DHCP server is configured to update DNS records automatically, ensure that the forward and reverse lookup zones are writable by the DHCP service account. Check if the client is receiving the correct DNS server addresses via Option 006. If the client receives a DNS server that is unreachable or misconfigured, it may fail to register its new IP, leading to connectivity issues that mimic IP problems.
For more insights on related networking diagnostics, see our guide on Can't ping router - Troubleshooting Network Connectivity Issues to rule out basic layer 3 connectivity faults.
Frequently Asked Questions
How do I find a rogue DHCP server on my network?
You can identify a rogue DHCP server by capturing network traffic with Wireshark and filtering for DHCP Offer packets. Analyze the source MAC address of these offers to determine the physical location of the unauthorized device, then disconnect it from the network.
Why is my client getting an APIPA address instead of a DHCP address?
An APIPA address (169.254.x.x) indicates that the client could not reach a DHCP server. This is often caused by a broken cable, a disabled switch port, or a firewall blocking UDP ports 67 and 68. Ensure the path between the client and the DHCP server is clear.
Can VLAN misconfiguration cause IP address conflicts?
Yes, if a switch port is assigned to the wrong VLAN, the DHCP request may be forwarded to a server that does not have a scope for that specific subnet. The server might then assign an address from a default scope or reject the request entirely, leading to connectivity failures.
What should I do if the DHCP server assigns an IP outside the expected range?
Check the scope configuration for overlapping ranges or incorrect subnet masks. Also, verify that the DHCP relay agent is pointing to the correct server IP and that the server has the appropriate scope enabled for the incoming request interface.
How does DNS affect DHCP IP assignment troubleshooting?
DNS does not directly assign IPs, but misconfigured DNS settings provided by DHCP can make a valid IP assignment appear broken. If the client cannot resolve hostnames, it may seem like the IP is wrong. Always verify that Option 006 (DNS Servers) is correctly configured in your DHCP scope.