DHCP server gets filled with BAD_ADDRESS

[Anders]

Hello, I noticed that all available IP adresses from the DHCP IP range lease
were depleted as it was full of "BAD_ADDRESS -This address is already in use"
entries and as I deleted it all they insist on returning after 5min. I
investigated this error message and it seems it is the result from statically
assigned IP addresses that already exist on the network but I really cannot
see how we would end up with 100+ static entries from one day to another.
(We're dealing with a rather small network of about 100 clients)

Do you have any ideas how to troubleshoot this so I can find out what is
causing my DHCP-server to act this way?
BTW, I do not know if it is significant for the troubleshooting but the
indicated unique IDs (MAC addresses) in the Win2003 server is a 8-digit value
with an increasing value pattern of xxxxc80a

[Robert L [MVP - Networking]]

Make sure the DHCP server is not multihomed computer and you don't have two DHCP servers in the network. This search result may help,

Windows ErrorsBad_address entry on a DHCP Server · “Cannot access folder because the path is too long or deep” · Delayed Write Failed ...

[Anders]

Well, the DHCP server IS a multihomed computer but the secondary NIC is
statically assigned and intended for backup operations only.
In order to spot any rouge servers I used the MSOFT utility DHCPLOC and
after clearing the erranous DHCP lease entries I started to listen on one
network interface with the following result: (Excerpt)

14:02:09 OFFER (IP)10.200.0.157 (S)10.200.0.11 ***
14:02:09 ACK (IP)10.200.0.157 (S)10.200.0.11 ***
14:02:15 ACK (IP)10.200.0.157 (S)10.200.0.11 ***
14:02:25 OFFER (IP)10.200.0.158 (S)10.200.0.11 ***
14:02:30 OFFER (IP)10.200.0.158 (S)10.200.0.11 ***
14:02:30 ACK (IP)10.200.0.158 (S)10.200.0.11 ***

Interestingly I noticed that these IP offers corresponded to the increasing
BAD_ADDRESS entries at the DHCP server and the (S)Server is the valid DHCP
server and nothing else.
Somehow the DHCP server seems to offer and also consume all remaining
addresses and I cannot see why.

[Anders]

P.S. The three stars(***) should indicate an unauthorized server but server
10.200.0.11 is indeed authorized so now I am really confused.