Re: DHCP giving out wrong subnet IP

Administrator <admin-JJaFKVBkT/[email protected]> Fri, 07 Apr 2017 06:51:11 +0100
Newsgroups gmane.comp.security.ipcop.user
Organization different perspectives
Message-ID <2975869.id5VK6WucZ@epping>
On Wednesday, 5 April 2017 13:35:09 BST Joe Acquisto-j4 wrote:
> Below is a snippet of the /var/messages log (dhcp tags only) from the date
> it was happening.  At one point, I unplugged the patch cord from the wlan
> port of the IPCop box and had the client request DHCP.    It then got the
> correct fixed lan address.
> 
> Apr  4 19:39:25 ipcop dnsmasq-dhcp[1199]:
> DHCPINFORM(lan-1) 192.168.11.199 aa:bb:cc:dd:ee:ff Apr  4 19:39:25 ipcop
> dnsmasq-dhcp[1199]: DHCPACK(lan-1) 192.168.11.199 aa:bb:cc:dd:ee:ff
> MININT-O9ERFLG Apr  4 19:39:28 ipcop dnsmasq-dhcp[1199]: DHCPINFORM(lan-1)
> 192.168.11.199 aa:bb:cc:dd:ee:ff Apr  4 19:39:28 ipcop dnsmasq-dhcp[1199]:
> DHCPACK(lan-1) 192.168.11.199 aa:bb:cc:dd:ee:ff MININT-O9ERFLG Apr  4
> 19:39:36 ipcop dnsmasq-dhcp[1199]: DHCPINFORM(lan-1) 192.168.11.199
> aa:bb:cc:dd:ee:ff Apr  4 19:39:36 ipcop dnsmasq-dhcp[1199]: DHCPACK(lan-1)
> 192.168.11.199 aa:bb:cc:dd:ee:ff MININT-O9ERFLG Apr  4 19:39:39 ipcop
> dnsmasq-dhcp[1199]: DHCPINFORM(lan-1) 192.168.11.199 aa:bb:cc:dd:ee:ff Apr 
> 4 19:39:39 ipcop dnsmasq-dhcp[1199]: DHCPACK(lan-1) 192.168.11.199
> aa:bb:cc:dd:ee:ff MININT-O9ERFLG Apr  4 19:42:27 ipcop dnsmasq-dhcp[1199]:
> DHCPDISCOVER(lan-1) 192.168.11.199 aa:bb:cc:dd:ee:ff Apr  4 19:54:32 ipcop
> dnsmasq-dhcp[1199]: DHCPOFFER(wlan-1) 192.168.11.199 aa:bb:cc:dd:ee:ff

Your don't say (information is useful) so I'm assuming that the 192.168.11.199 
address is in your blue subnet and the connection is on your green one.

Three immediate things from this log:
1) a quick search of the internet shows that (broken) windows clients 
repeatedly send out DHCPINFORMs if they don't receive proxy information in the 
DHCP info.  There are multiple fixes available.  A search will find them for 
you.

2) The client has an IP Address in a non-default range, so it was given it 
some time by something.  Valid addresses don't appear by magic, so either: 
it's old - from a previous network; it's old - from a previous configuration of 
this network; it's connected to your Blue network at some time and is now 
trying to reuse these parameters; you've manually configured it on the client, 
at some time.

3) dhcpmasq is again acking a wrong address.

I'd suggest:
1) research and change the dhcpmasq parameters so the dhcpinforms stop.  You 
can't fix a broken window.

2) tell the offending clients so the release the IP Address and then request a 
new one.

3) log a defect report on ipcop.

Yours
David

------------------------------------------------------------------------------
Check out the vibrant tech community on one of the world's most
engaging tech sites, Slashdot.org! http://sdm.link/slashdot
_______________________________________________
IPCop-user mailing list
[email protected]
Manage your subscription or unsubscribe
https://lists.sourceforge.net/lists/listinfo/ipcop-user