0

I have a host that's picking up a DHCP-assigned address that's wrong. Specifically, the MAC address is reserved to a particular address in the DHCP server, and instead of getting that address, something else has received that address and the client is getting another random address.

I'm trying to work out if something else on the network is offering DHCP leases (which would explain all this very concretely) but unfortunately with the switchover from good old dhcp-client to network manager, it's no longer possible to do it this way since there is no dhclient.leases file. There are also no log entries for DHCPOFFER, and no dhcp-server-identifier in /var/lib/NetworkManager/*.lease

This seems like valuable debugging information, so it would be nice if it existed somewhere on the system and wasn't simply being discarded; if the address is already assigned during the boot process, it isn't exactly straightforward to tcpdump to inspect the packets...

Greg Nelson
  • 73

1 Answers1

1

A) DHCP client diagnose

It is simple, but sometimes not sufficient. The "multiple DHCP server problem" sometimes requires more advanced analysis.

IP address release and renew:

sudo dhclient -v -r
sudo dhclient -v

Shortened example of command response is:

DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 3 (xid=0xc4b0e053)
DHCPACK of 10.1.1.110 from 10.1.1.1 (xid=0xeb675d5d)

Search for from clause in list, e.g. ... from 10.1.1.1 .... It is DHCP server address from which your client got IP address.

B) Network packet diagnose

It is very useful and reliable kind of diagnose. Install Wireshark and capture DHCP packets.

sudo apt-get install wireshark

During Wireshark installation confirm option saying that all users can capture data.

Add wireshark group to your user:

sudo usermod -aG wireshark <your_user_name>
groups <your_user_name>

Second command above verifies the wireshark group is added to you.

Logout and login or reboot PC. Then start Wireshark. Select your LAN interface from interface list and start capturing.

Put bootp or udp.port==67 or udp.port==68 string into capture filter field in Wireshark window. The field is on top. You can find it very easy, inside it is text: "Apply a display filter". Press enter after putting the filter clause text.

Put commands in terminal to enforce DHCP activity:

sudo dhclient -v -r
sudo dhclient -v

Watch packets in Wireshark main field. You will see IP addresses of remote device sending DHCP offers.

Unpack "Dynamic Host Configuration Protocol" line and check the details.

netbat
  • 1,221