Multiple DHCP servers Detected

[zfrangi]

I keep getting alerts in my event logs about Multiple DHCP servers being detected.  Im running all Meraki MR34's in our environment and our dhcp servers reside on our windows servers.  Is there any way I can find out where this is coming from?

[zfrangi]

Forgot to mention in the logs it shows a mac address which when I look it up it come back to cisco. Im assuming its our switch however to my knowledge they arent doing dhcp.  

[BrandonS]

The MAC addresses are your clue. You need to check what devices they match in your network. 

[BlakeRichardson]

If you go to Switches > Monitor > DHCP & ARP it should give you a list of active DHCP servers on your network. 

If you don't have Meraki switches I would run a packet capture and see if you can work out what devices respond to a DHCP request. 

[zfrangi]

I do not have meraki switches...I have cisco switches.  How can I go about tracking down this mac address?

[zfrangi]

I have a dumb question on this event log entries....I see the following.....

vap: 0, original_server_ip: 172.22.81.29, original_server_mac: 30:E4:DB:13:C7:46  

server_ip	172.22.66.2
server_mac	30:E4:DB:13:C7:46

So which one is the dhcp server? I guess my question is how do I decipher whats going on here?

[zfrangi]

After further investigation i was able to uncover that  66.2 is a vlan interface on the switch. There is an ip helper entry that points to 81.29 which is a windows dhcp server.  So is this entry normal behavior?  

Im seeing similar messages on all of our networks.  

[Johnmccsi]

I had this issue with multiple IP helpers configured on an SVI. Especially if you use ISE for profiling.I believe Meraki support can make a back end change for this.

[Mark_B7]

Hi,

Did you get an answer to this from Meraki ? Is it normal behaviour?

Thanks

Mark