[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Bug#743335: debian-installer: udhcpc does not get first IP-address it asked for



My educated  guess: there is rogue DHCP server


On Mon, Sep 14, 2015 at 04:04:56PM +0200, Oliver Kopp wrote:
> > Please elaborate:
> >   It seems that uhcpc treats the first answer only.
> 
> I think, I conclude that based on the following udhcpc output:
> --cut--
> udhcpc (v1.21.1) started
> Sending discover...
> Sending select for 10.0.1.28...
> Received DHCP NAK
> /etc/udhcpc/default.script: Received a NAK: requested address not available
> Sending discover...
> Sending select for 129.69.214.124...
> Received DHCP NAK
> /etc/udhcpc/default.script: Received a NAK: requested address not available
> Sending discover...
> Sending select for 129.69.214.124...
> (and so on, starting from "Received DHCP NAK")
> --end--

That is what bugsummitter also reported. (bugsubmitter added in To: )
In http://oi59.tinypic.com/k3swtw.jpg you see the many 'Received DHCP NAK' 


@Oliver:  I, stappers, understand your "It seems that uhcpc treats the first answer only."
(thanks)


> dhclient gives following output
> --cut--
> Internet Systems Consortium DHCP Client 4.2.4
> Copyright 2004-2012 Internet Systems Consortium.
> All rights reserved.
> For info, please visit https://www.isc.org/software/dhcp/
> 
> Listening on LPF/eth0/00:50:56:85:c2:a2
> Sending on   LPF/eth0/00:50:56:85:c2:a2
> Sending on   Socket/fallback
> DHCPREQUEST of 10.0.1.27 on eth0 to 255.255.255.255 port 67      (xid=0x58dd7a8a)
> DHCPNAK from 129.69.214.3                                        (xid=0x8a7add58)
> DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 3       (xid=0xf89915c)
> DHCPREQUEST of 129.69.214.131 on eth0 to 255.255.255.255 port 67 (xid=0x5c91890f)
> DHCPOFFER of 129.69.214.131 from 129.69.214.2
> DHCPNAK from 10.0.1.1                                            (xid=0xf89915c)
> DHCPNAK from 10.0.1.1                                            (xid=0xf89915c)
> DHCPACK of 129.69.214.131 from 129.69.214.3
> bound to 129.69.214.131 -- renewal in 11815 seconds.
> --end--

Mmm, four different transaction IDs (xid).
I see it as a sign of a rogue DHCP server.



> > My advice to Oliver: Check your LAN and search for 10.0.1.1. That 10.0.1.1. is from
> >> Sep 14 12:25:53 iaas2 dhcpd: DHCPREQUEST for 10.0.1.28 (10.0.1.1) from 00:50:56:85:c2:a2 via eth0
> 
> Yeah, I'm trying to find that host. As I don't have access to the
> routers for myself, I have to rely on other guys.

I come back to that in seperate message.


> Here the logs when using udhcpc:
> 
> DHCP Server 1:
> --cut--
> Sep 14 14:36:58 iaas1 dhcpd: DHCPDISCOVER from 00:50:56:85:c2:a2 via eth0
> Sep 14 14:36:58 iaas1 dhcpd: DHCPREQUEST for 10.0.1.28 (10.0.1.1) from 00:50:56:85:c2:a2 via eth0: wrong network.
> Sep 14 14:36:58 iaas1 dhcpd: DHCPNAK on 10.0.1.28 to 00:50:56:85:c2:a2 via eth0
> Sep 14 14:36:59 iaas1 dhcpd: DHCPOFFER on 129.69.214.124 to 00:50:56:85:c2:a2 via eth0

The expected DHCPOFFER  \o/


> Sep 14 14:37:01 iaas1 dhcpd: DHCPDISCOVER from 00:50:56:85:c2:a2 via eth0
> Sep 14 14:37:01 iaas1 dhcpd: DHCPOFFER on 129.69.214.124 to 00:50:56:85:c2:a2 via eth0
> Sep 14 14:37:01 iaas1 dhcpd: DHCPREQUEST for 129.69.214.124 (129.69.214.2) from 00:50:56:85:c2:a2 via eth0
> Sep 14 14:37:01 iaas1 dhcpd: DHCPACK on 129.69.214.124 to 00:50:56:85:c2:a2 via eth0

Those four are the typical D.O.R.A. four


> (and looping from DHCPDISCOVER from 00:50:56:85:c2:a2 via eth0)
> --end--
> 
> DHCP Server 2:
> --cut--
> Sep 14 14:36:58 iaas2 dhcpd: DHCPDISCOVER from 00:50:56:85:c2:a2 via eth0: load balance to peer iaas

And due
 > We have a failover setting here.
I now understand the 'load balance to peer'

> Sep 14 14:36:58 iaas2 dhcpd: DHCPREQUEST for 10.0.1.28 (10.0.1.1) from 00:50:56:85:c2:a2 via eth0: wrong network.
> Sep 14 14:36:58 iaas2 dhcpd: DHCPNAK on 10.0.1.28 to 00:50:56:85:c2:a2 via eth0
> Sep 14 14:37:01 iaas2 dhcpd: DHCPDISCOVER from 00:50:56:85:c2:a2 via eth0: load balance to peer iaas
> Sep 14 14:37:01 iaas2 dhcpd: DHCPREQUEST for 129.69.214.124 (129.69.214.2) from 00:50:56:85:c2:a2 via eth0
> Sep 14 14:37:01 iaas2 dhcpd: DHCPACK on 129.69.214.124 to 00:50:56:85:c2:a2 via eth0
> Sep 14 14:37:01 iaas2 dhcpd: bind update on 129.69.214.124 from iaas rejected: incoming update is less critical than outgoing update
> (and looping from DHCPDISCOVER from 00:50:56:85:c2:a2 via eth0)
> --end--
> 
> Cheers,
> 
> Oliver


Groeten
Geert Stappers
-- 
Leven en laten leven


Reply to: