My educated guess: there is rogue DHCP server
On Mon, Sep 14, 2015 at 04:04:56PM +0200, Oliver Kopp wrote: > > Please elaborate: > > It seems that uhcpc treats the first answer only. > > I think, I conclude that based on the following udhcpc output: > --cut-- > udhcpc (v1.21.1) started > Sending discover... > Sending select for 10.0.1.28... > Received DHCP NAK > /etc/udhcpc/default.script: Received a NAK: requested address not available > Sending discover... > Sending select for 129.69.214.124... > Received DHCP NAK > /etc/udhcpc/default.script: Received a NAK: requested address not available > Sending discover... > Sending select for 129.69.214.124... > (and so on, starting from "Received DHCP NAK") > --end-- That is what bugsummitter also reported. (bugsubmitter added in To: ) In http://oi59.tinypic.com/k3swtw.jpg you see the many 'Received DHCP NAK' @Oliver: I, stappers, understand your "It seems that uhcpc treats the first answer only." (thanks) > dhclient gives following output > --cut-- > Internet Systems Consortium DHCP Client 4.2.4 > Copyright 2004-2012 Internet Systems Consortium. > All rights reserved. > For info, please visit https://www.isc.org/software/dhcp/ > > Listening on LPF/eth0/00:50:56:85:c2:a2 > Sending on LPF/eth0/00:50:56:85:c2:a2 > Sending on Socket/fallback > DHCPREQUEST of 10.0.1.27 on eth0 to 255.255.255.255 port 67 > (xid=0x58dd7a8a) > DHCPNAK from 129.69.214.3 > (xid=0x8a7add58) > DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 3 > (xid=0xf89915c) > DHCPREQUEST of 129.69.214.131 on eth0 to 255.255.255.255 port 67 > (xid=0x5c91890f) > DHCPOFFER of 129.69.214.131 from 129.69.214.2 > DHCPNAK from 10.0.1.1 > (xid=0xf89915c) > DHCPNAK from 10.0.1.1 > (xid=0xf89915c) > DHCPACK of 129.69.214.131 from 129.69.214.3 > bound to 129.69.214.131 -- renewal in 11815 seconds. > --end-- Mmm, four different transaction IDs (xid). I see it as a sign of a rogue DHCP server. > > My advice to Oliver: Check your LAN and search for 10.0.1.1. That 10.0.1.1. > > is from > >> Sep 14 12:25:53 iaas2 dhcpd: DHCPREQUEST for 10.0.1.28 (10.0.1.1) from > >> 00:50:56:85:c2:a2 via eth0 > > Yeah, I'm trying to find that host. As I don't have access to the > routers for myself, I have to rely on other guys. I come back to that in seperate message. > Here the logs when using udhcpc: > > DHCP Server 1: > --cut-- > Sep 14 14:36:58 iaas1 dhcpd: DHCPDISCOVER from 00:50:56:85:c2:a2 via eth0 > Sep 14 14:36:58 iaas1 dhcpd: DHCPREQUEST for 10.0.1.28 (10.0.1.1) from > 00:50:56:85:c2:a2 via eth0: wrong network. > Sep 14 14:36:58 iaas1 dhcpd: DHCPNAK on 10.0.1.28 to 00:50:56:85:c2:a2 via > eth0 > Sep 14 14:36:59 iaas1 dhcpd: DHCPOFFER on 129.69.214.124 to 00:50:56:85:c2:a2 > via eth0 The expected DHCPOFFER \o/ > Sep 14 14:37:01 iaas1 dhcpd: DHCPDISCOVER from 00:50:56:85:c2:a2 via eth0 > Sep 14 14:37:01 iaas1 dhcpd: DHCPOFFER on 129.69.214.124 to 00:50:56:85:c2:a2 > via eth0 > Sep 14 14:37:01 iaas1 dhcpd: DHCPREQUEST for 129.69.214.124 (129.69.214.2) > from 00:50:56:85:c2:a2 via eth0 > Sep 14 14:37:01 iaas1 dhcpd: DHCPACK on 129.69.214.124 to 00:50:56:85:c2:a2 > via eth0 Those four are the typical D.O.R.A. four > (and looping from DHCPDISCOVER from 00:50:56:85:c2:a2 via eth0) > --end-- > > DHCP Server 2: > --cut-- > Sep 14 14:36:58 iaas2 dhcpd: DHCPDISCOVER from 00:50:56:85:c2:a2 via eth0: > load balance to peer iaas And due > We have a failover setting here. I now understand the 'load balance to peer' > Sep 14 14:36:58 iaas2 dhcpd: DHCPREQUEST for 10.0.1.28 (10.0.1.1) from > 00:50:56:85:c2:a2 via eth0: wrong network. > Sep 14 14:36:58 iaas2 dhcpd: DHCPNAK on 10.0.1.28 to 00:50:56:85:c2:a2 via > eth0 > Sep 14 14:37:01 iaas2 dhcpd: DHCPDISCOVER from 00:50:56:85:c2:a2 via eth0: > load balance to peer iaas > Sep 14 14:37:01 iaas2 dhcpd: DHCPREQUEST for 129.69.214.124 (129.69.214.2) > from 00:50:56:85:c2:a2 via eth0 > Sep 14 14:37:01 iaas2 dhcpd: DHCPACK on 129.69.214.124 to 00:50:56:85:c2:a2 > via eth0 > Sep 14 14:37:01 iaas2 dhcpd: bind update on 129.69.214.124 from iaas > rejected: incoming update is less critical than outgoing update > (and looping from DHCPDISCOVER from 00:50:56:85:c2:a2 via eth0) > --end-- > > Cheers, > > Oliver Groeten Geert Stappers -- Leven en laten leven
