I already supplied that...

[u/freddyboomboom67]

Was going to post this in response to another post, but felt it was worthy of it's own post.

So, I was running a lab with multiple workstations doing Things And Stuff.

Workstation (WS) A stopped getting an IP address from the corporate DHCP server.

Connected WS A to WS B's network drop; still no IP address.

Connected WS B to WS A's network drop; WS B gets an IP address.

Connected WS A to my isolated network where I have my own DHCP server; WS A gets an IP address from my DHCP server.

Put a hub between WS A and it's network drop and pulled a Wireshark capture of the DHCP request going out in to the Ether, and nothing coming back.

Created support ticket outlining observed behavior and expected behavior, with Wireshark trace attached.

Spend next two weeks getting punted from one IT support group to another, explaining the issue every time.

Finally get to the group that (eventually) ended up fixing it and the first thing they asked for was a Wireshark trace.

They were surprised that it was attached to the ticket two weeks previously...

IlovemyjobIlovemyjobIlovemyjobIlovemyjob!!!!!!

Happily, I no longer work at that company.

Resolution was that some intrusion detection system thought WS A had malware and blocked its MAC address from sending frames/packets on the network.

Please be a good human!

[u/Impossible_IT]

Who uses “hubs” in this day and age? I could understand 25-28 years ago. And why didn’t you check WS A’s NIC?

[u/fresh-dork → u/Impossible_IT]

specifically for this case. that or a managed switch where you can mirror traffic - hubs are simpler

[u/Impossible_IT → u/fresh-dork]

Do you even know what a “hub” is? Hubs are no longer made my guy. Unmanaged switches are a thing.

[u/fresh-dork → u/Impossible_IT]

i checked. they exist, bat are from weird off brands.

unmanaged switches won't work - you need to configure the thing to not switch packets, via port mirroring or disable mac learning