Multiple alerts for the same DHCP servers

[bit_transporter]

Hi all,

We have enabled alerts for new DHCP server detection on our MS250s. Is it normal behavior for these alerts to come in multiple times for the same server? For example, we run a couple DHCP servers that were first seen by Meraki about 2 years ago. But it seems every time we have to reboot a switch or it loses and regains cloud connectivity, it will begin sending the DHCP alerts all over again for the same servers. 

Just wanting to rule out any config or network problems that could cause these alerts.

Thank you

[alemabrahao]

Can you give us an example of the alert message you are receiving?

[bit_transporter]

Sure, it's the ones generated when you check this in the Configuration Template alert settings:

Looks like this:

The switch in the network XYZ detected a new DHCP server with the following details:

MAC: aa:bb:cc:dd:ee:ff
IP: 10.80.8.50
VLAN: 60
Subnet: 172.18.254.0/24

- Cisco Meraki

[alemabrahao]

Check this.

https://documentation.meraki.com/MX/DHCP/Tracking_Down_Rogue_DHCP_Servers

But it's a good idea to perform a packet capture, just to make sure there's nothing abnormal on the network.

[BlakeRichardson]

Alerts will inform when a DHCP server is enabled at any stage but also if you have one that isn't used often and has been sitting idle for some time I have found that when it does provide a lease the Meraki dashboard will send an alert. 

I've never seen the behaviour you are seeing just by rebooting a switch. 

[bit_transporter]

That's interesting, and I think i have noticed that too. Sometimes we will just get a random alert saying new DHCP server detected but of course it's the same one it should already have seen.

What's odd is we did an upstream router hardware replacement last night, and afterward it sent these alerts all night. No one has reported any issues, so I am assuming it may be a quirk with the Meraki system.

[PhilipDAth]

I don't know the answer - but I suspect you'll get an alert whenever it sees a DHCP server not currently displayed in the list (and those are time based).