Hi all,
I have dhcpd running on interface xl0:
$>ps aux | grep dhcpd
_dhcp 6850 0.0 0.2 632 1020 ?? Is 3:24PM 0:00.01 dhcpd xl0
xl0 is 1 of three interfaces on a gateway with ip forwarding enabled. 1
interface services an internet line. 1 interface (dc0) services network
192.168.2/24. xl0 services network 192.168.1/24.
My problem is that most of the time DHCP requests from network 2 are
answered by the gateway (thales) with a network 1 address. I made a
tcpdump of a typical DHCP process for the MAC adress involved
(00:19:66:75:68:bf). Now in this case you see both thales and device
192.168.2.254 (some fritzbox) making DHCP offers. Eventually you see the
request setteling for address 192.168.2.6, which is desired but
circumstantial. In my opinion thales should not have made it's offer
(192.168.1.90) since the requesting device (xccube) is on a different
network and therefor other device.
$>sudo tcpdump -i xl0 -vvv -s 1500 '((port 67 or port 68) and (udp[38:4]
= 0x19667568bf))'
tcpdump: listening on xl0, link-type EN10MB
16:21:53.149948 0.0.0.0.bootpc > 255.255.255.255.bootps: [udp sum ok]
xid:0x9cf53d1c vend-rfc1048 DHCP:DISCOVER T116:1
CID:1.0.25.102.117.104.191 RQ:192.168.1.15 HN:"xccube"
VC:77.83.70.84.32.53.46.48 PR:SM+DN+DG+NS+WNS+WNT+WSC+RD+SR+249+VO
VO:220.0 (ttl 64, id 33544, len 328)
16:21:53.150850 192.168.2.254.bootps > 255.255.255.255.bootpc: [udp sum
ok] xid:0x9cf53d1c Y:192.168.2.6 S:192.168.2.254 ether 00:19:66:75:68:bf
vend-rfc1048 DHCP:OFFER SID:192.168.2.254 LT:4294967295 SM:255.255.255.0
DG:192.168.2.254 NS:192.168.2.254 (ttl 64, id 14904,len 328)
16:21:53.151374 thales.mercatortrading.nl.bootps > 192.168.1.90.bootpc:
[udp sum ok] xid:0x9cf53d1c Y:192.168.1.90 S:thales.mercatortrading.nl
vend-rfc1048 DHCP:OFFER SID:thales.mercatortrading.nl LT:43200
SM:255.255.255.0 DN:"thales.mercatortrading.nl"
DG:thales.mercatortrading.nl
NS:google-public-dns-a.google.com,google-public-dns-b.google.com
RN:21600 RB:37800 [tos 0x10] (ttl 16, id 0, len 345)
16:21:56.145577 0.0.0.0.bootpc > 255.255.255.255.bootps: [udp sum ok]
xid:0x9cf53d1c vend-rfc1048 DHCP:REQUEST CID:1.0.25.102.117.104.191
RQ:192.168.2.6 SID:192.168.2.254 HN:"xccube" T81:0,120,25443,30050,25902
VC:77.83.70.84.32.53.46.48 PR:SM+DN+DG+NS+WNS+WNT+WSC+RD+SR+249+VO
VO:220.1.0 (ttl 64, id 33593, len 341)
16:21:56.146466 thales.mercatortrading.nl.bootps >
255.255.255.255.bootpc: [udp sum ok] xid:0x9cf53d1c flags:0x8000
S:thales.mercatortrading.nl ether 00:19:66:75:68:bf vend-rfc1048
DHCP:NACK MSG:"requested address not available" [tos 0x10] (ttl 16, id
0, len 328)
16:21:56.146758 192.168.2.254.bootps > 255.255.255.255.bootpc: [udp sum
ok] xid:0x9cf53d1c Y:192.168.2.6 S:192.168.2.254 ether 00:19:66:75:68:bf
vend-rfc1048 DHCP:ACK SID:192.168.2.254 LT:4294967295 SM:255.255.255.0
DG:192.168.2.254 NS:192.168.2.254 (ttl 64, id 14950, len 328)
16:22:00.145563 0.0.0.0.bootpc > 255.255.255.255.bootps: [udp sum ok]
xid:0x9cf53d1c vend-rfc1048 DHCP:REQUEST CID:1.0.25.102.117.104.191
RQ:192.168.2.6 SID:192.168.2.254 HN:"xccube" T81:0,120,25443,30050,25902
VC:77.83.70.84.32.53.46.48 PR:SM+DN+DG+NS+WNS+WNT+WSC+RD+SR+249+VO
VO:220.1.0 (ttl 64, id 33602, len 341)
16:22:00.146482 192.168.2.254.bootps > 255.255.255.255.bootpc: [udp sum
ok] xid:0x9cf53d1c Y:192.168.2.6 S:192.168.2.254 ether 00:19:66:75:68:bf
vend-rfc1048 DHCP:ACK SID:192.168.2.254 LT:4294967295 SM:255.255.255.0
DG:192.168.2.254 NS:192.168.2.254 (ttl 64, id 15009, len 328)
16:22:00.146535 thales.mercatortrading.nl.bootps >
255.255.255.255.bootpc: [udp sum ok] xid:0x9cf53d1c flags:0x8000
S:thales.mercatortrading.nl ether 00:19:66:75:68:bf vend-rfc1048
DHCP:NACK MSG:"requested address not available" [tos 0x10] (ttl 16, id
0, len 328)
16:22:06.474639 192.168.2.254.bootps > 255.255.255.255.bootpc: [udp sum
ok] xid:0xfb3941a6 C:192.168.2.6 Y:192.168.2.6 S:192.168.2.254 ether
00:19:66:75:68:bf vend-rfc1048 DHCP:ACK SID:192.168.2.254 LT:4294967295
SM:255.255.255.0 DG:192.168.2.254 NS:192.168.2.254 (ttl 64, id 15021,
len 328)
16:22:06.497490 192.168.2.6.bootpc > 255.255.255.255.bootps: [udp sum
ok] xid:0x3bb5802a C:192.168.2.6 vend-rfc1048 DHCP:INFORM
CID:1.0.25.102.117.104.191 HN:"xccube" VC:77.83.70.84.32.53.46.48
PR:SM+DN+DG+NS+WNS+WNT+WSC+RD+SR+249+VO+252 VO:220.1.0 (ttl 64, id
33628, len 328)
16:22:09.489187 192.168.2.6.bootpc > 255.255.255.255.bootps: [udp sum
ok] xid:0x3bb5802a secs:768 C:192.168.2.6 vend-rfc1048 DHCP:INFORM
CID:1.0.25.102.117.104.191 HN:"xccube" VC:77.83.70.84.32.53.46.48
PR:SM+DN+DG+NS+WNS+WNT+WSC+RD+SR+249+VO+252 VO:220.1.0 (ttl 64, id
33677, len 328)
An arp lookup for ip 192.168.2.6 shows xccube indeed is on device dc0
and not xl0
$>arp 192.168.2.6
? (192.168.2.6) at 00:19:66:75:68:bf on dc0
The tcpdump was taken on interface xl0 (i.e. -i xl0). So it seems
something is forwarding the traffic to the xl0 interface. I guess that
is actually what ip forwarding means. Does anyone have any thoughts on
how to tackle this?
Cheers,
Jasper
