Monitoring and Troubleshooting the DHCP Server

Using Event Viewer to Monitor DHCP Activity

You can use the Event Viewer tool, located in the Administrative Tools folder, to monitor DHCP activity. Event Viewer stores events that are logged in the system log, application log, and security log. The system log contains events that are associated with the operating system. The application log stores events that pertain to applications running on the computer. Events that are associated with auditing activities are logged in the security log. All events that are DHCP-specific are logged in the System log. The DHCP system event log contains events that are associated with activities of the DHCP service and DHCP server, such as when the DHCP server started and stopped, when DHCP leases are close to being depleted, and when the DHCP database is corrupt.

A few DHCP system event log IDs are listed below:

Using System Monitor to Monitor DHCP Activity

The System Monitor utility is the main tool for monitoring system performance. System Monitor can track various processes on the Windows system in real time. The utility uses a graphical display that you can use to view current data, or log data. You can specify specific elements or components that should be tracked on the local computer and remote computers. You can determine resource usage by monitoring trends. System Monitor can be displayed in a graph, histogram, or report format. System Monitor uses objects, counters and instances to monitor the system

System Monitor is a valuable tool when you need to monitor and troubleshooting DHCP traffic being passed between the DHCP server and DHCP clients. Through System Monitor, you can set counters to monitor:

To start System Monitor,

  1. Click Start, Administrative Tools, and then click Performance.
  2. When the Performance console opens, open System Monitor

The DHCP performance counters that you can monitor to track DHCP traffic are:

Using Network Monitor to Monitor DHCP Lease Traffic

You can use Network Monitor to monitor network traffic, and to troubleshoot network issues or problems. Network Monitor shipped with Windows Server 2003 allow you to monitor network activity and use the gathered information to manage and optimize traffic, identify unnecessary protocols, and to detect problems with network applications and services. In order to capture frames, you have to install the Network Monitor application and the Network Monitor driver on the server where you are going to run Network Monitor. The Network Monitor driver makes it possible for Network Monitor to receive frames from the network adapter.

The two versions of Network Monitor are:

Because of these features, you can use Network Monitor to monitor and troubleshoot DHCP lease traffic. You can use the Network Monitor version included in Windows Server 2003 to capture and analyze the traffic being received by the DHCP server. Before you can use Network Monitor to monitor DHCP lease traffic, you first have to install it. The Network Monitor driver is automatically installed when you install Network Monitor.

How to install Network Monitor

  1. Click Start, and then click Control Panel.
  2. Click Add Or Remove Programs to open the Add Or Remove programs dialog box.
  3. Click Add/Remove Windows Components.
  4. Select Management and Monitoring Tools and click the Details button.
  5. On the Management and Monitoring Tools dialog box, select the Network Monitor Tools checkbox and click OK.
  6. Click Next when you are returned to the Windows Components Wizard.
  7. If prompted during the installation process for additional files, place the Windows Server 2003 CD-ROM into the CD-ROM drive.
  8. Click Finish on the Completing the Windows Components Wizard page.

Capture filters disregard frames that you do not want to capture before they are stored in the capture buffer. When you create a capture filter, you define settings that can be used to detect the frames that you do want to capture. You can design capture filters in the Capture Window to only capture specific DHCP traffic, by selecting Filter from the Capture menu. You can also create a display filter after you have captured data. A display filter enables you to decide what is displayed.

How to start a capture of DHCP lease traffic in Network Monitor

  1. Open Network Monitor.
  2. Use the Tools menu to click Capture, and then click Start.
  3. If you want to examine captured data during the capture, select Stop And View from the Capture menu.

Understanding DHCP Server log Files

DHCP server log files are comma-delimited text files. Each log entry represents one line of text. Through DHCP logging, you can log many different events. A few of these events are listed below:

The DHCP server log file format is depicted below. Each log file entry has the fields listed below, and in this particular order as well:

DHCP server log files use reserved event ID codes. These event ID codes describe information on the activities being logged. The actual log file only describes event ID codes which are lower than 50.

A few common DHCP server log event ID codes are listed below:

The following DHCP server log event ID codes are not described in the DHCP log file. These DHCP server log event ID codes relate to the DHCP server’s Active Directory authorization status:

How to change DHCP log files location

  1. Open the DHCP console.
  2. Right-click the DHCP server node and select Properties from the shortcut menu.
  3. The DHCP Server Properties dialog box opens.
  4. Click the Advanced tab.
  5. Change the audit log file location in the Audit Log File Path text box.
  6. Click OK.

How to disable DHCP logging

  1. Open the DHCP console.
  2. Right-click the DHCP server node and select Properties from the shortcut menu.
  3. The DHCP Server Properties dialog box opens.
  4. On the General tab, clear the Enable DHCP Audit Logging checkbox to disable DHCP server logging.
  5. Click OK.

Troubleshooting the DHCP Client Configuration

A DHCP failure usually exists when the following events occur:

When these events occur, one of the first tasks you need to perform is to determine whether the connectivity issues occurred because of the actual DHCP client configuration, or whether it occurred because of some other network issue. You do this by determining the address type of the IP address of the DHCP client.

To determine the address type,

  1. Use the Ipconfig command to determine if the client received an IP addresses lease from the DHCP server.
  2. The client received an IP address from the DHCP server if the Ipconfig /all output displays:
    • The DHCP server as being enabled
    • The IP address is displayed as IP Address. It should not be displayed as Autoconfiguration IP Address.
  3. You can also use the status dialog box for the network connection to determine the IP address type for the client.
  4. To view this information, double-click the appropriate network connection in the Network Connections dialog box.
  5. Click the Support tab.
  6. The IP address type should be displayed as being Assigned By DHCP.

If after the above checks, you can conclude that the IP address was assigned to the client by the DHCP server, some other network issue is the cause of the DHCP server connectivity issues being experienced. The issue is not due to an IP addressing issue on the client.

When clients have the incorrect IP address, it was probably due to the computer not being able to contact the DHCP server. When this occurs, the computer assigns its own IP address through Automatic Private IP Addressing (APIPA).

Computers could be unable to contact the DHCP server for a number of reasons:

When a DHCP client is assigned an IP address that is currently being used by another client, then an address conflict has occurred.

The process that occurs to detect duplicate IP addresses is illustrated below:

  1. When the computer starts, the system checks for any duplicate IP addresses.
  2. The TCP/IP protocol stack is disabled on the computer when the system detects duplicate IP addresses.
  3. An error message is shown that indicates the hardware address of the other system that this computer is in conflict with.
  4. The computer that initially owned the duplicate IP address experiences no interruptions, and operates as normally.
  5. You have to reconfigure the conflicting computer with a unique IP address so that the TCP/IP protocol stack can be enabled on that particular computer again.

When address conflicts exist, a warning message is displayed:

Addresses conflicts usually occur under the following circumstances:

One of the following methods can be used to renew your DHCP client leases:

When you click the Repair button of the status dialog box (Support tab) of the connection to renew the DHCP client lease, the following process occurs:

  1. A DHCPREQUEST message is broadcast on the network to renew your DHCP clients’ IP address leases.
  2. The ARP cache is flushed.
  3. The NetBIOS cache is flushed.
  4. The DNS cache is flushed.
  5. The NetBIOS name and IP address of the client is registered again with the WINS server.
  6. The computer name and IP address of the client is registered again with the DNS server.

You can enable server-side conflict detection through the following process

  1. Open the DHCP console
  2. Right-click the DHCP server in the console tree, and select Properties from the shortcut menu.
  3. When the Server Properties dialog box opens, click the Advanced tab.
  4. Set the number of times that the DHCP server should run conflict detection prior to it leasing an IP address to a client.
  5. Click OK.

A few troubleshooting strategies which you can use when a DHCP client cannot obtain an IP address from the DHCP server, are summarized below:

A few troubleshooting strategies which you can use when a DHCP client obtains an IP address from the incorrect scope are summarized below:

Troubleshooting the DHCP Server Configuration

If you have clients that cannot obtain IP addresses from the DHCP server, even though they can contact the DHCP server, verify the following:

When you need to verify the configuration of the DHCP server, use the following process:

Troubleshooting DHCP Database Issues

The DHCP service uses a number of database files to maintain DHCP-specific data or information on IP addresses leases, scopes, superscopes, and DHCP options. The DHCP database files that are located in the systemroot\System32\DHCP folder are listed below. These files remain open while the DHCP service is running on the server. You should therefore not change any of these files while the DHCP service is running.

If you need to change the role of the DHCP server, and move its functions to another server, it is recommended that you migrate the DHCP database to the new DHCP server. This strategy prevents errors that occur when you manually attempt to recreate information in the DHCP database of the destination DHCP server.

To migrate an existing DHCP database to a new DHCP server,

  1. Open the DHCP console.
  2. Right-click the DHCP server whose database you want to move to a different server, and select Backup from the shortcut menu.
  3. When the Browse For Folder dialog box opens, select the folder to which the DHCP database should be backed up. Click OK.
  4. To prevent the DHCP server from allocating new IP addresses to clients once the DHCP server database is backed up, you have to stop the DHCP server.
  5. Open the Services console.
  6. Double-click the DHCP server.
  7. When the DHCP Server Properties dialog box opens, select Disable from the Startup Type drop down list.
  8. Proceed to copy the folder which contains the backup to the new DHCP server. You now have to restore the DHCP backup at the destination DHCP server.
  9. Open the DHCP console.
  10. Right-click the destination DHCP server for which you want to restore the DHCP database, and select Restore from the shortcut menu.
  11. When the Browse For Folder dialog box opens, select the folder that contains the back up of the database that you want to restore. Click OK.
  12. Click Yes when prompted to restore the database, and to stop and restart the DHCP service.

If your lease information in the DHCP database does not correspond to the actual IP addresses leased to clients on the network, you can delete your existing database files, and commence with a clean (new) database. To do this,

  1. Stop the DHCP service.
  2. Remove all the DHCP database files from the systemroot\system32\DHCP folder.
  3. Restart the DHCP service.
  4. You can rebuild the contents of the database by reconciling the DHCP scopes. The DHCP console is used for this.

When DHCP database information is inconsistent with what is on the network, corrupt, or when information is missing, you can reconcile DHCP data for the scopes to recover the database. The DHCP service stores IP addresses lease data as follows:

These sets of information are compared when scopes are reconciled. Before you can reconcile the DHCP server’s scopes, you first have to stop the DHCP service running on the server. You can repair any inconsistencies which are detected by the comparison between the contents of the DHCP database, and the contents of the Registry.

How to reconcile the DHCP database

  1. Open the DHCP console
  2. Right-click the DHCP server for which you want to reconcile the DHCP database, and then select Reconcile All Scopes from the shortcut menu. The Reconcile All Scopes command also appears as an Action menu item.
  3. When the Reconcile All Scopes dialog box opens, click Verify to start the DHCP database reconciliation process.
  4. When no inconsistencies are reported, click OK.
  5. When inconsistencies are detected, select the addresses which need to be reconciled, and then click Reconcile.
  6. The inconsistencies are repaired.

How to reconcile a single scope

  1. Open the DHCP console
  2. In the console tree, expand the DHCP server node that contains the scope which you want to reconcile.
  3. Right-click the scope and then select Reconcile from the shortcut menu.
  4. When the Reconcile All Scopes dialog box opens, click Verify to start the scope reconciliation process.
  5. When no inconsistencies are detected, click OK.
  6. When inconsistencies are detected, select the addresses which need to be reconciled, and then click Reconcile.
  7. The inconsistencies are repaired.


Top 5 Free Networking Tools

Bookmark Monitoring and Troubleshooting the DHCP Server

Latest Blog Posts


English English GermanGerman SpanishSpanish FrenchFrench ItalianItalian PortuguesePortuguese RussianRussian DutchDutch
GreekGreek HindiHindi JapaneseJapanese KoreanKorean ChineseChinese Chinese (Simplified)Chinese (Simplified) ArabicArabic

Copyright 2009 Tech-FAQ. All rights reserved. Privacy Policy.