DHCP Exhaustion & DNS Failures — 'Network Is Up But Users Cannot Connect'

! On Cisco IOS DHCP server:

! Step 1: Check pool status immediately
show ip dhcp pool
! Shows for each pool:
! Total addresses: 254 (or whatever your pool size is)
! Leased addresses: 253     ← near pool maximum = exhaustion
! Available addresses: 1    ← one address remaining

! Step 2: Check binding details
show ip dhcp binding
! Lists every active lease with:
! IP address, hardware address (MAC), lease expiry time
! Count the entries — if it equals pool size, pool is full

! Step 3: Find leases that may be stale (expired but still showing)
show ip dhcp binding | include Expired
! These are leases that should have been cleaned up but were not

! Step 4: Check for lease conflicts
show ip dhcp conflict
! A conflict means an IP was discovered on the network that was NOT assigned by this server
! This removes that IP from the pool automatically — conflicts reduce available addresses

! Step 5: See DHCP server statistics
show ip dhcp server statistics
! Look for:
! Messages received: DISCOVER, REQUEST, RELEASE, DECLINE counts
! High DECLINE count = address conflicts (clients are declining offered addresses)
! Zero RELEASE count = clients are not properly releasing addresses when disconnecting

! Option 1: Clear expired bindings immediately
clear ip dhcp binding *
! WARNING: This clears ALL bindings — active clients will need to request new addresses
! Users will experience a brief disconnection while DHCP renews
! Best done outside business hours if possible
! If during business hours — clear one subnet at a time:
clear ip dhcp binding 10.1.1.0 255.255.255.0

! Option 2: Clear only confirmed stale leases
! First identify IPs that are leased but do not respond to ping:
! (Run from DHCP server or a device that can reach all subnets)
! Then clear specific bindings:
clear ip dhcp binding 10.1.1.150

! Option 3: Temporarily expand the pool (immediate relief)
ip dhcp pool VLAN10
  network 10.1.1.0 255.255.254.0
! Expand from /24 (254 addresses) to /23 (510 addresses)
! Requires IP space to be available — coordinate with network planning

! Option 4: Reduce lease time to force faster recycling:
ip dhcp pool VLAN10
  lease 0 4
! Sets lease time to 4 hours instead of 1 day
! Stale leases will recycle 6x faster
! Tradeoff: increases DHCP traffic as clients renew more frequently

! Step 1: Test DNS resolution from the affected client
nslookup google.com
! If this returns "Server: Unknown" or times out — DNS server is unreachable
! If this returns the IP — DNS works, problem is elsewhere

! Specify the DNS server explicitly to test connectivity:
nslookup google.com 8.8.8.8
nslookup google.com 10.1.1.10
! If external DNS works but internal DNS fails: internal DNS server problem
! If both fail: DNS traffic is being blocked (firewall rule or routing issue)

! From Linux/macOS:
dig google.com @10.1.1.10
! Shows full DNS response including query time and server used
! Query time of 3000ms+ = DNS server is responding but very slowly

! Step 2: Check if DNS server is reachable at all
ping 10.1.1.10
! If ping fails: routing issue, not DNS
! If ping succeeds: DNS service is down or not responding on port 53

! Test specifically on port 53:
nslookup -timeout=5 -retry=1 google.com 10.1.1.10
! If this fails but ping succeeds: DNS service is not running on that server

! Step 3: Check DHCP-assigned DNS servers
! On Windows client:
ipconfig /all | findstr DNS
! Verify DNS server IPs are correct
! A wrong DNS server IP (from DHCP misconfiguration) causes all resolution failures

! Step 4: On Cisco IOS acting as DNS forwarder:
show ip dns view
show ip dns cache
! Shows what the router knows about DNS — if forwarding is configured correctly

! If the DNS server is a Windows Server running Active Directory DNS:
! On the DNS server itself:

! Check DNS service status:
Get-Service -Name DNS
! Should be: Status = Running
! If stopped: Start-Service DNS — and investigate why it stopped

! Check DNS server logs:
Get-WinEvent -LogName "DNS Server" -MaxEvents 50 | Where-Object {$_.LevelDisplayName -ne "Information"}
! Look for: zone transfer failures, database corruption errors, forwarder failures

! Test DNS resolution from the server to itself:
nslookup google.com 127.0.0.1
! If this fails on the DNS server: the service itself is the problem
! If this succeeds: problem is network between clients and DNS server

! Check if Active Directory replication is affecting DNS:
repadmin /showrepl
! AD DNS zones replicate via AD replication — if replication is broken, DNS zones can be stale

! Check forwarder configuration:
dnscmd /info /forwarders
! If forwarders are unreachable: external DNS resolution fails while internal resolution works
! This creates partial failure — internal resources resolve, external do not