Join Log in
Score:0
Greg Nelson avatar Ubuntu

Determine DHCP lease source in Ubuntu 20.04 desktop

us flag
Greg Nelson

I have a host that's picking up a DHCP-assigned address that's wrong. Specifically, the MAC address is reserved to a particular address in the DHCP server, and instead of getting that address, something else has received that address and the client is getting another random address.

I'm trying to work out if something else on the network is offering DHCP leases (which would explain all this very concretely) but unfortunately with the switchover from good old dhcp-client to network manager, it's no longer possible to do it this way since there is no dhclient.leases file. There are also no log entries for DHCPOFFER, and no dhcp-server-identifier in /var/lib/NetworkManager/*.lease

This seems like valuable debugging information, so it would be nice if it existed somewhere on the system and wasn't simply being discarded; if the address is already assigned during the boot process, it isn't exactly straightforward to tcpdump to inspect the packets...

65
0 + 0
Greg Nelson avatar
us flag
Greg Nelson
@guiverc I retitled the question, hopefully that made it unambiguous.
0
Reply
Score:0
netbat avatar Ubuntu
br flag
netbat

A) DHCP client diagnose

It is simple, but sometimes not sufficient. The "multiple DHCP server problem" sometimes requires more advanced analysis.

IP address release and renew:

sudo dhclient -v -r
sudo dhclient -v

Shortened example of command response is:

DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 3 (xid=0xc4b0e053)
DHCPACK of 10.1.1.110 from 10.1.1.1 (xid=0xeb675d5d)

Search for from clause in list, e.g. ... from 10.1.1.1 .... It is DHCP server address from which your client got IP address.

B) Network packet diagnose

It is very useful and reliable kind of diagnose. Install Wireshark and capture DHCP packets.

sudo apt-get install wireshark

During Wireshark installation confirm option saying that all users can capture data.

Add wireshark group to your user:

sudo usermod -aG wireshark <your_user_name>
groups <your_user_name>

Second command above verifies the wireshark group is added to you.

Logout and login or reboot PC. Then start Wireshark. Select your LAN interface from interface list and start capturing.

Put bootp or udp.port==67 or udp.port==68 string into capture filter field in Wireshark window. The field is on top. You can find it very easy, inside it is text: "Apply a display filter". Press enter after putting the filter clause text.

Put commands in terminal to enforce DHCP activity:

sudo dhclient -v -r
sudo dhclient -v

Watch packets in Wireshark main field. You will see IP addresses of remote device sending DHCP offers.

Unpack "Dynamic Host Configuration Protocol" line and check the details.

0 + 0
Greg Nelson avatar
us flag
Greg Nelson
Thank you. This worked perfectly. Since I simply needed to track down the IP address of the server whose DHCPOFFER was accepted, I didn't need to go through the wireshark (or tcpdump) process to chase down packets, but I am sure that will be helpful to someone.
0
Reply
netbat avatar
br flag
netbat
You are welcome. Yes, you are right. It is overkill if only basic test is needed. But tcpdump or Wireshark are useful if e.g. two DHCP servers send offers and it is necessary to get more details (MAC addresses, response times, differences in offer etc.). A fake or forgotten unwanted DHCP server can destroy almost all client addresses and their communication in broadcast domain.
0
Reply
ธงชาติไทย
Elon Musk
I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.