169.254.X.X - "Invalid IP Config" errors

[kenpojosh]

I work at a place that takes calls for customers with computer issues. We've been seeing quite an increase in calls the last couple of days. The common theme is customer’s computer is pulling a 169.254.X.X IP Address and getting an error “Invalid IP Configuration” as a result. The majority of the reports are from today (Dec. 6, 2016) but we had some reports from yesterday too. Customers are from all over the midwest with some in Texas, Utah, Nevada as well.

What We Know:

• 169.254.X.X IP Addresses
• Primarily Windows 10. Seen some Win 7 as well.
• Customers have different Internet providers.

 Essentially fixed by releasing / renewing the IP Address. This can be done a few different ways. Winsock Resets, ipconfig/release & renew, etc.

• No known Windows Updates. Last updates I found were pushed out nearly a month ago.
• Random routers so we can’t fault a particular router type. (Netgear, Linksys, Gigacenter, Belkin, etc.)
• Random AV programs. (SecureIT, Norton, Avast, McAfee)
• Seen a couple different types of Network Adapters, (Realtek, Intel)

 Just posting to see if anyone else has seen this and can think of any reason for this to be happening.

[David H. Lipman]

The IP Address Scheme of 169.254.x.y is called "IP Auto Configuration" and occurs when a computer sees that it can access a network but can not get an IP address from a DHCP Server.  This can happen when an Ethernet cable is connected to an Ethernet port or via Wifi.  In the case of wired Ethernet it can be because the Nietwork Interface card ( NIC ) or chip-set is set to  automatically detect the Speed and Duplex of the network it is connected to.  Such as when a Gigabit Ethernet NIC is connected to a 10/100 Mb/s hub.  If you change the speed to 100 Mb/s half-duplex manually it then works.  Some NICS don't work well with some auto-detection devices and they can't negotiate a speed and thus the PC auto-generates the IP Address in the 169.254.x.y IP range.

 

 

[kenpojosh]

32 minutes ago, David H. Lipman said:

The IP Address Scheme of 169.254.x.y is called "IP Auto Configuration" and occurs when a computer sees that it can access a network but can not get an IP address from a DHCP Server.  This can happen when an Ethernet cable is connected to an Ethernet port or via Wifi.  In the case of wired Ethernet it can be because the Nietwork Interface card ( NIC ) or chip-set is set to  automatically detect the Speed and Duplex of the network it is connected to.  Such as when a Gigabit Ethernet NIC is connected to a 10/100 Mb/s hub.  If you change the speed to 100 Mb/s half-duplex manually it then works.  Some NICS don't work well with some auto-detection devices and they can't negotiate a speed and thus the PC auto-generates the IP Address in the 169.254.x.y IP range.

 

 

My issue is not how the auto-config IP issue occurs. Our call volume here has increased by 50% or more here in the last two days because of this issue. We haven't been able to nail down a particular network card or router or driver update, but it sure seems like something happened to affect all of these computers.

[David H. Lipman]

You haven't even described the topology or posted a topographic map of the network.

Like a road map you can follow the connections look at the problem from a physical and logical perspective.

If it is a wired network you can insert a hub and a notebook with a promiscuous NIC and sniff the packets with Wireshark and examine the Physical Layer and the Data Link Layer packets and work up the OSI model.

 

[kenpojosh]

I don't know how to describe this topology. Physically the network is diverse. We have seen about 300 calls so far today from customers who use about 40 different Internet providers around the country. These are Cable Modem users, DSL users, Fiber connections, etc. Most of these customers have a modem and a router and are connected thru a wired or wireless connection. They don't have complex systems or anything beyond a modem / router and their devices. They just notice when a device doesn't connect. We get on the PC and find it has a 169.254.X.X link local IP.

[kenpojosh]

I started posts on TechNet and Bleeping Computer as well. Found another on Reddit that I have been adding comments to. This seems to be an international issue affecting Win 10 computers.

- I've seen a few thoughts about WIndows Defender floating around or the Windows 10 Fast Start it does when the PC boots / wakes from hibernation, etc.

[miletx-com]

We know what causes 169.254.x.x Why is it happening on a large broad scale?

Our hypothesis is possibly a time-bomb or alternative non-TCP issue

We have seen it on computers:
Windows 8.1
Windows 7
Windows 10

Computers that no policy
Computers that have a policy to only allow iexplore.exe and no Windows Updates enabled
Computers that had a Windows Update day but no updates occurred
Computers that had a Windows Update day and did have updates occur

We have seen it on providers:
AT&T
Comcast
Consolidated Communications
CBeyond/Birch

We have seen it on routers:
Linksys (various)
Consolidated
AT&T/Netgear

We have seen it on WiFi as well as hard wired ethernet various network cards:
Broadcomm
Realtek
Atheros

Some symptoms are even on static IP address computers where IP address was 192.168.21.251 and the NIC displayed both the static IP address AND DHCP IPV4 address simultaneously 169.254.x.x and then the NIC alternating between having a valid static IP address for a second, then having both, then resetting and starting over again.

What has worked combined or sometimes just one of these sections solved it:
run cmd as administrator
ipconfig /release
ipconfig /renew
remove/uninstall network card from computer management
Scan for hardware changes
run cmd as administrator
netsh winsock reset catalog
netsh int ip reset reset.log
Our worst case scenario was to use a WiFi Card in place of the hardwired Ethernet card as a temporary work around.

 

[Aura]

That might be interesting...

http://www.theregister.co.uk/2016/12/12/ongoing_windows_8_10_dhcp_problems_affecting_all_isps/

[miletx-com]

Update-

Solution:
I found the solution for me. I had 169.254.x.x and also a static IP address simultaneously on the same NIC. That's really not possible or valid. I tried DHCP and then back to static and couldn't fix it. I ended up setting an IP address on that NIC 192.168.1.111 and then going to advanced and adding a second IP address 192.168.1.222 to have two IP addresses on the same NIC. This somehow pushed out the DHCP Autoconfiguration. I then set my NIC back to DHCP and that solved that issue. I then set my NIC back to a static IP address which is what I wanted in the end. It solved the double conundrum of DHCP and static IP addresses simultaneously on the same NIC issue. I had a functioning DHCP server and DHCP was not working properly by internally handing out an autoconfiguration IP address of 169.254.x.x on NIC. DHCP works now. Static works now.
-miletx.com

[David H. Lipman]

Actually, it is valid.  One can tie multiple addresses to one NIC, Each with their own Netmask. This is a type of Multihomed addressing sheme.

This is something I have done numerous times when setting up a Print Server.

I do like your idea to take advantage of IP AutoConfiguration on the LAN client by applying it as a new DHCP Configuration setting on the SOHO Router as a "fix" to what appears to be another major Screw-Up by Microsoft

[Tabeer]

You can do the following steps:

Method 1:

- Open the "Services" app (search for Services)

- locate the "DNS Client" service

- Restart the "DNS Client" service (right click on it, restart(

Method 2:

Do a clean reboot of your system:

Either by holding your Shift Key while shutting the device down,

or by issuing the command  shutdown /s /f /t 0 (in the console or with Windows+R)

Method 3:

Set a static IP address for your WiFi/Ethernet device  (various tutorials on this can easily be found online)

[KingOfDemise]

I am replying to this because I have a similar issue. I have the 169.254.x.x ip address and the invalid ip configuration just as others have had, but none of the command promts have even changed anything for me. I tryed a new NIC, redownloaded drivers, tryed assigning the correct ip address, and done quite a few other things and none of them worked. I ended up running my Windows 10 setup and let it go through the download again and after it restarted it connected right up to the internet. But as soon as i either restart the pc or turn it off and turn it back on it goes back to the 169.254.x.x ip and nothing works untill i do the Windows download trick. I used Malwarebytes and Webroot and neither of them can find any threats. I am thinking it is malware since nothing has fixed it settings wise, but I can't be certain since neither antivirus found anything. Does anybody have any ideas? Ipconfig and netsh commands don't do anything. And if I plug a different pc in at the same Ethernet cable that one works fine. So it is the pc and not the modem or router.

[Wendysmith]

I have this issue with one computer in my house.  After Windows Creators Update, lost internet.  I have done all suggestions with no luck.  Even restored to Windows 10 before Creators Update.  Nothing works.  All other computers in my house work perfectly.  I would like some help.

[Firefox]

54 minutes ago, Wendysmith said:

I have this issue with one computer in my house.  After Windows Creators Update, lost internet.  I have done all suggestions with no luck.  Even restored to Windows 10 before Creators Update.  Nothing works.  All other computers in my house work perfectly.  I would like some help.

Have you read the post that @Aura posted above in #8?  It has a fix.

Basically go to a CMD Prompt with Administrative Rights

Once the CMD window opens type these two commands (hit the enter key after each command)

netsh winsock reset catalog
netsh int ipv4 reset reset.log
 

[Wendysmith]

3 hours ago, Firefox said:

Have you read the post that @Aura posted above in #8?  It has a fix.

Basically go to a CMD Prompt with Administrative Rights

Once the CMD window opens type these two commands (hit the enter key after each command)

netsh winsock reset catalog
netsh int ipv4 reset reset.log
 

It did not work.  Tried it several times.

[Firefox]

Let's try and get some logs first so the team can review them and see if they can tell what may be causing your issues....

1. FIRST: Create and obtain Farbar Recovery Scan Tool (FRST) logs
2. Download FRST and save it to your desktop
   NOTE: You need to run the version compatible with your system. You can check here if you're not sure if your computer is 32-bit or 64-bit
3. Double-click to run FRST and when the tool opens click "Yes" to the disclaimer
4. Press the "Scan" button
5. This will product two files in the same location (directory) as FRST: FRST.txt and Addition.txt
   NOTE: These two files will be collected by the MB-Check Tool and added to the zip file for you
6. NEXT: Create and obtain an mb-check log
7. Download MB-Check and save to your desktop
8. Double-click to run MB-Check and within a few second the command window will open, then click "OK"
9. This will produce one log file on your desktop: mb-check-results.zip
10. Attach this file to your forum post by clicking on the "Drag files here to attach, or choose files..." or simply drag the file to the attachment area
    

Thank You,

Firefox

[AdvancedSetup]

@Firefox the user @Wendysmith is already being assisted in Malware Removal

 

 

[Firefox]

10 hours ago, AdvancedSetup said:

@Firefox the user @Wendysmith is already being assisted in Malware Removal

OK, Thanks Ron...