Network Management
IPAM IP Addresses still show Used even if the IPs do not respond to ping and Neighbor Scanning is disabled
This article explained why IPAM IP Addresses still show Used even if the IPs are not pingable and neighbor scanning is disabled.
First published date
Last published date
Overview
By design, IPAM performs ICMP "Ping" to check the status of IP Addresses, and if ICMP is not responding, IPAM uses "Indirect Discovery (Neighbor Scanning)" to poll the status via SNMP (ARP).
IPs may still show Used with hostname and MAC, even if the IP is not pingable and the Neighbor Scanning on the subnet is disabled.
For Windows DHCP-managed IPs, IPAM sets the IP address status based on the DHCP lease in the DHCP server database, retrieved via the DHCP server APIs/WMI rather than only ICMP/SNMP.
Product section
Cause
Expired Leases.
DHCP Scopes keep returning expired records.
Resolution
The Windows DHCP API — which IPAM uses to sync — keeps returning expired records until the DHCP server's database cleanup runs.
The DHCP console hides expired leases, creating the apparent discrepancy in which IPAM shows them as Used while the admin sees no active leases.
To view if a lease still exists for the given scope using the below PowerShell command:
Get-DhcpServerv4Lease -scopeId xxx.xxx.xxx.xxx -AllLeases
Leases for the given scope can be removed using the below PowerShell command:
-Remove the specific stale VPN leases
Remove-DhcpServerv4Lease -ComputerName "hostname" -IPAddress "xxx.xxx.xxx.xx"
To delete all leases in the entire scope at once:
Get-DhcpServerv4Lease -ComputerName "hostname" -ScopeId "xxx.xxx.xxx.xxx | Remove-DhcpServerv4Lease
Another solution:
In the DHCP console: right-click Scope → Reconcile. This fixes database inconsistencies and can flush orphaned records that don't correspond to active bindings.