[PLUG] dhclient(?) providing it's own dhcp address?

Sean Whitney sean.whitney at gmail.com
Wed Jul 18 14:15:35 UTC 2007


I will assume that the IP scope you are getting a lease on is 192.168.100.x

The cable modem itself is giving you lease, this is by design.  It
allows for internal troubleshooting so that techs can view modem
information.

This is standard on most cable modems.

Try going to 192.168.100.1 and see what you get.

I have a route in my firewall, that allows me to see this even when my
IP is being served by Comcast's DHCP server.

Sean

Keith Lofstrom wrote:
> Some weird behavior for DHCP.   Perhaps dhclient causing this:
>
> Comcast has gone out a couple of times in the last three days, an
> hour or two each time.  After it goes away, my firewall ("f") starts
> doing the normal DHCP client thing, asking for a new IP address.
> The funny thing is that it seems to get one, in the address space
> of the internal network!
>
> Of course, nothing routes, the TTL is about 10 seconds, and that
> interface goes down and starts up again with the next IP address.
> So the interface is assigned 192.168.31.2,  192.168.31.3,
> 192.168.31.4, and so forth (the name of the "31" subnet is changed
> to protect the innocent ).
>
> At first I was tearing my hair out, thinking that somebody was out
> there on the local segment, impersonating my internal DHCP server
> for nefarious purposes.  Then I suspected my own DHCP server, but
> turning that off had no effect, and besides it only serves addresses
> over a small range in the upper part of the local address space. 
>
> So, I'm not sure what is doing the DHCP ACK on that interface;
> I'm guessing that dhclient is talking to itself, and logging the
> behavior to /var/log/messages in a misleading way:
>
>   ...
>   Jul 17 18:37:47 f dhclient: DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 7
>   Jul 17 18:37:47 f dhclient: DHCPOFFER from 192.168.31.1
>   Jul 17 18:37:47 f dhclient: DHCPREQUEST on eth1 to 255.255.255.255 port 67
>   Jul 17 18:37:47 f dhclient: DHCPACK from 192.168.31.1
>   Jul 17 18:37:48 f dhclient: bound to 192.168.31.79 -- renewal in 7 seconds.
>   Jul 17 18:37:48 f dhclient: receive_packet failed on eth1: Network is down
>   Jul 17 18:37:55 f dhclient: DHCPREQUEST on eth1 to 192.168.31.1 port 67
>   Jul 17 18:38:01 f dhclient: DHCPREQUEST on eth1 to 192.168.31.1 port 67
>   Jul 17 18:38:09 f dhclient: DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 3
>   Jul 17 18:38:09 f dhclient: send_packet: Network is down
>   Jul 17 18:38:12 f dhclient: DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 4
>   Jul 17 18:38:16 f dhclient: DHCPDISCOVER on eth1 to 255.255.255.255 port 67 interval 4
>   Jul 17 18:38:16 f dhclient: DHCPOFFER from 192.168.31.1
>   Jul 17 18:38:16 f dhclient: DHCPREQUEST on eth1 to 255.255.255.255 port 67
>   Jul 17 18:38:16 f dhclient: DHCPACK from 192.168.31.1
>   Jul 17 18:38:17 f dhclient: bound to 192.168.31.80 -- renewal in 10 seconds.
>   Jul 17 18:38:17 f dhclient: receive_packet failed on eth1: Network is down
>   Jul 17 18:38:27 f dhclient: DHCPREQUEST on eth1 to 192.168.31.1 port 67
>   Jul 17 18:38:34 f dhclient: DHCPREQUEST on eth1 to 255.255.255.255 port 67
>   Jul 17 18:38:34 f dhclient: DHCPACK from 192.168.31.1
>   Jul 17 18:38:34 f dhclient: bound to 192.168.31.80 -- renewal in 10 seconds.
>   Jul 17 18:38:44 f dhclient: DHCPREQUEST on eth1 to 192.168.31.1 port 67
>   Jul 17 18:38:50 f dhclient: DHCPREQUEST on eth1 to 192.168.31.1 port 67
>   ...
>
> Anyone have a better idea about why this is happening?
>
> Keith
>
>   



More information about the PLUG mailing list