Vista DHCP Broadcast flag and D-Link routers

Last year at Rigshospitalets Kollegium, we’ve were having problems with Vista machines on the network. Vista users (myself included) were experiencing IP-conflict errors all the time. Our DHCP server was well configured and there was no rogue DHCP servers and the fact that only Vista machines were effected let me to believe that there was in fact no IP-conflicts but it was just Vista messing up. Vista had a part in it of course, but it turned out that a couple of D-Link routers actually were to blame.

One change from XP SP2 to Vista was that a DHCP broadcast flag was now by default enabled. Here’s a Microsoft KB article describing the change and how to disable it through the registry. Disabling the broadcast flag on a computer seemed to do the trick, but with 420 users and not all of them beeing computer litterate enough to fix their registry this wasn’t an option.

There also was the matter of why this even occured in the first place. Our DHCP servers did support the broadcast flag and Vista users reported getting an IP from our DHCP servers for a moment before loosing it and beeing alerted of the ip-conflict.

Using WireShark I started packet sniffing, which brought up a really interesting picture.

Wireshark: DHCP and ARP packets

What’s going on here is this:

• Packet 1: DHCP Request from Vista machine with no IP (0.0.0.0)

• Packet 2: DHCP Offer (172.20.129.35) from our DHCP server (172.20.0.44)

• Packet 3: DHCP Request from Vista machine, requesting the offered IP

• Packet 4: DHCP Acknowledgement from our DHCP server.

• Packet 5: -UNRELATED ARP TRAFFIC-

• Packet 6: Vista machine asks via ARP who (if any) has the IP it just got assigned (in order to prevent IP-conflicts)

• Packet 7: A D-Link router asks the exact same question (it’s relaying the request, but to the same network…)

• Packet 8: Vista machine interprets this as a hint that the IP is taken and therefore releases it’s lease on the IP address (sends a DHCP decline packet). The user of the Vista machine now gets a pop-up alerting him that an IP-conflict occured.

Now why the D-LINK would respond with an identical ARP broadcast package on it’s WAN-interface is beyond me. It turned out we had two D-LINK 524 routers on our network, which were the cause. We had our two users promise not to use the WAN-port on the router and instead use the router as a wireless switch (by disabling the the DHCP server and utilizing the LAN-ports on the router instead). Problem fixed!

I’ve read many reports of problems with Vista machines and IP-conflicts, many of those related to the DHCP broadcast flag. But I can’t help wonder in how many cases the underlying cause might have been the combination of Vista and a D-Link router…
As an example Skive Kollegierne were also affected. And apparently it’s not only model 524 routers that behave like this… the problems described here might indicate that there’s also the same problems with other models.

If you’re only worried about yourself and you suspect the DHCP broadcast flag might be the culprit, you should take a look at these ressources:
DHCP Fix Tool 1.2 : Easy tool that’ll allow you to fix the problem without hacking the registry.
One of the dozens of explanations out there on the registry entries and how to change them.