Users unable to get IP address after several months running normally!

[flavio_borup]

My ZD is 9.9.0.0 build 216 and i can ́t do any change right now
I have several old APs which doesn ́t allow me to upgrade

I ́m running this very same solution in the last 3 years with no problems at all

Yesterday, some users complain about the were unable to get IP addresses

My DHCP Server is a Windows 2012
My Ruckus environment have 12 APs and several SSIDs and Serveral VLANs
My network uses HP/3COM Switchs models 2600, 5550, etc


After doing a investigation:

The problem only affected a single SSID and is related to a single VLAN
At DHCP Server logs, i can see SOME clients are still able to get IPs, but randomly, some users can ́t. After some network tracing, i can see DHCP requests arriving at DHCP Server and all requests that come to DHCP are served with no problem. 

But the clients with problems, the DHCP request does not arrive at the interface, for some reason, the traffic was blocked at some point and the DHCP packets were not arriving at the DHCP Server.. Again, for some clients, other can connect with no problem.

Yesterday, afet several months of uptime i rebooted my ZD and all things got normal again. Ok, maybe it was a "glitch", anyway, after the reboot.. everyting got back normal

Today, the problem is back! After some tests i did the following: I changed the VLAN ID of the SSID and clients were able to get IP address again (each VLAN has its own IP range), so, in the new range, things were nromal. And, after re-configuring back as before, the problem was gone. First a reboot, now a little change in configuration to solve the problem. Weird!

Some monutes ago, the problem is back again! and i didnpt reboot yet, but now, no matter what change i do, the problem is here, some clients can leas IPs and some not (randomly) and if the pacjets arrive at DHCP Server they ́re leased with no problem, but some packets simply didn ́t arrive at the DHCP Server interface to be processed

So, what ́s next? What should I do?

[andrew_giancol1]

Best of luck, don't forget to investigate implementing DHCP IP SNOOPING commands on your switches equivalent. this will limit a Rogue DHCP server's impact on your network. Also, you might consider moving those Chinese MACs to a Nul Vlan, and or checking for duplicate IP's associated with the network. ARPING is your friend when it comes to finding these same network duplicate IPs. 

[karimovic]

in wireshark(WS);
capture>options
in the WS - Capture interfaces box hit the "manage interfaces" button
in the Manage Interfaces Box, hit "Remote Interfaces" tab
see: https://inro.in/lucky-patcher/ , https://inro.in/9apps/ & https://inro.in/vidmate/