Date: Thu, 16 Jan 2003 09:11:15 -0600 From: "Mark Johnston" <mjohnston@skyweb.ca> To: <lewwid@telusplanet.net> Cc: <freebsd-stable@freebsd.org> Subject: RE: Freebsd 4.7.2 DHCP Spamming Message-ID: <004e01c2bd71$84213c80$690fa8c0@MJOHNSTON> In-Reply-To: <2W5ZNJANISMB91VMJPMIG4XD83XPN71.3e25f76b@Jeff>
next in thread | previous in thread | raw e-mail | index | archive | help
lewwid@telusplanet.net wrote: > Has anyone heard of an issue where a freebsd box can rack up > multiple ips over the course > of ~2 days? There should only be 1 ip address allocated to my box. > > For some reason on Dec 2nd, Dec 30th, and Jan 14th my box > decided to keep requesting IPs, thus > racking up ~100 before they shut me off each time. Why would > they keep permitting ip requests > above the 2 allowed ips? DOCSIS modems (at least the older ones that I'm familiar with) can be configured to limit the total number of MAC addresses or of IPs. Perhaps they're limiting MACs and you're getting a bunch of leases assigned to the same MAC ID. Another possibility is that their IP cap may only limit the number of IPs you can use, not the number you can request. If you are using xDSL, I'm not familiar with the modems involved, but the filters are probably similar. > I'm running a GENERIC kernel, all source updated and > installed from cvsup3.freebsd.org. Only ssh > listening. > > They say that, either I'm doing it on purpose, I'm exploited, > or there's a problem with the dhclient. You could also be having a packet filtering problem. When dhclient tries to get an IP and has none, it uses a broadcast request from 0.0.0.0 (aka DHCPDISCOVER.) The server will respond with a broadcast (a DHCPOFFER) to offer you the IP, then you will request it (with a DHCPREQUEST) and the server will acknowledge you (by sending a DHCPACK.) All of this is carried out in broadcast packets. When it comes time to renew, you will send a unicast request to the server and it will respond in kind. If this unicast can't make it through (due to packet filtering), you will only be able to get an IP when your lease has expired, not renew an existing one. Strange of their server to give you a different one each time though. Here's a remote possibility: Are you using any kind of automatic ipfw or ipf tie-in IDS? Sometimes ISPs will do foolish things, like performing diagnostic work from an important server. If that sets off an alarm and you block it, so much for DHCP renewals. If someone who thinks they're funny decides to spoof you a packet purporting to be from the DHCP server, and it upsets your IDS, you'll be in the same boat. > I was monitoring the box using tcpdump + dhcpdump to watch > the requests. Unfortunately I rebooted after about > 5 days (Jan 7th ish). I thought the problem was resolved. I > asked them for logs but they can't provide any. Having tcpdump output to a file with something like "udp port 67 or udp port 68" would provide the most detailed logs from your end, although checking what dhclient has logged to syslog would help too. > Could they changed something near the end of November, or the > start of December as this problem has > not happened *ever* in 6 years before this. > > *** Somehow I'm supposed to solve this problem without logs. > Hopefully someone has run into this > problem in the past and knows a solution. It's to never > happen again or > they will cancel my account. At this point, you are better safe than sorry. Buy a cheap Linksys broadband router, put it in between the modem and your PC, and troubleshoot your original issue at your leisure. It will protect you from your ISP's wrath until you have found the cause of the problem. Mark note - I am stuck with Outlook at work. Apologies if it destroys the formatting of this message. To Unsubscribe: send mail to majordomo@FreeBSD.org with "unsubscribe freebsd-stable" in the body of the message
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?004e01c2bd71$84213c80$690fa8c0>