LinuxQuestions.org
Share your knowledge at the LQ Wiki.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 09-25-2014, 10:47 AM   #1
cli
Member
 
Registered: Apr 2013
Distribution: RedHat, Cent, Ubuntu
Posts: 80

Rep: Reputation: Disabled
IP address automatically changing to DHCP


Hi All,
I am using CentOS-6.5 and configured static IP using NetworkManger(GUI). But this static IP will be often changing to DHCP IP automatically. This is happening since past couple of weeeks and still I couldn't find out the issue. I also tried below ipables rules block dhcp offer but no luck and still it is changing itself to DHCP but there is no any specific time for that(to get DHCP IP).
Code:
iptables -I INPUT 1 -p udp --dport 67:68 --sport 67:68 -j DROP
iptables -I OUTPUT 1 -p udp --dport 67:68 --sport 67:68 -j DROP
if I check the log(/var/log/messages) I found and entry related to dhcp as from 0.0.0.0.
So I am suspecting that anybody trying to gain access to my PC with such spoofed IPs or any daemon is changing to DHCP IP.
Expecting your kind help.
 
Old 09-26-2014, 04:57 AM   #2
chrism01
LQ Guru
 
Registered: Aug 2004
Location: Sydney
Distribution: Centos 6.8, Centos 5.10
Posts: 17,240

Rep: Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324Reputation: 2324
1. turn off Network Mgr; its a pain in the ....
Code:
chkconfig NetworkManager off
2. check/edit the relevant ifcg-ethX file eg /etc/sysconfig/network-scripts/ifcfg-eth0 and
check by running ifconfig to see which ethX is being used
Code:
ONBOOT=yes
NM_CONTROLLED=no
BOOTPROTO=static
3. Also, check your dhcp server for your MAC address and ensure its not set to receive a dhcp assigned IP.
See examples http://www.linuxtopia.org/online_boo...ml#config-file


... and yes, that all applies to Centos6.x as much as it does v5.x
 
1 members found this post helpful.
Old 09-26-2014, 11:48 AM   #3
cli
Member
 
Registered: Apr 2013
Distribution: RedHat, Cent, Ubuntu
Posts: 80

Original Poster
Rep: Reputation: Disabled
Guru,
No, It did not help even after the static IP, service NetworkManager stop; chkconfig NetworkManager off. Also there is no DHCP reservation in the server side for my PC. So is there any other way that I can completely block dhcp request to my PC. Also request you to check the above mentioned IP Tables rules are correct to block dhcp IP.

Last edited by cli; 10-09-2014 at 11:17 AM.
 
Old 11-11-2014, 11:41 PM   #4
cli
Member
 
Registered: Apr 2013
Distribution: RedHat, Cent, Ubuntu
Posts: 80

Original Poster
Rep: Reputation: Disabled
Hi All,
Still I am facing the same problem, can anybody please suggest how can I completely block dhcp request. Because of this the many downloads(copying backup files using scp) from servers are terminating in the middle and then again I am deleting those incompleted scp files and restarting the downloads. I have already updated the packages using "yum update" command.
Excepting your kind help, I am using CentOS release 6.5 (Final) 64 bit O/S.
 
Old 11-12-2014, 12:23 AM   #5
timl
Member
 
Registered: Jan 2009
Location: Sydney, Australia
Distribution: Fedora,CentOS
Posts: 581

Rep: Reputation: 126Reputation: 126
assuming you are using eth0 could you pls dump the contents of /etc/sysconfig/network-scripts/ifcfg-eth0?

Best to remove MAC add and anything sensitive.

And a copy of /sbin/ifconfig would be helpful. Again, remove all sensitive stuff.

Cheers
 
1 members found this post helpful.
Old 11-12-2014, 01:38 AM   #6
cli
Member
 
Registered: Apr 2013
Distribution: RedHat, Cent, Ubuntu
Posts: 80

Original Poster
Rep: Reputation: Disabled
Hi timl,
Thanks for the reply.
Code:
assuming you are using eth0 could you pls dump the contents of /etc/sysconfig/network-scripts/ifcfg-eth0?

Here is contents of that file.
# cat /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
TYPE=Ethernet
UUID=38b32f16-e22c-4d41-bea6-cff7c1e6ded5
ONBOOT=yes
NM_CONTROLLED=no
BOOTPROTO=static
DEFROUTE=yes
IPV4_FAILURE_FATAL=yes
IPV6INIT=no
#NAME="System eth0"
HWADDR=xx:yy:zz:12:34:56 # original mac has been removed.
IPADDR=192.168.0.37 
PREFIX=24
GATEWAY=192.168.0.1
DNS1=192.168.0.100
DNS2=192.168.0.1
DOMAIN=mylocaldomain.com
#LAST_CONNECT=1411126879
Code:
Best to remove MAC add and anything sensitive.
Pls let me know what all the minimal entries are enough in this file.
Code:
And a copy of /sbin/ifconfig would be helpful. Again, remove all sensitive stuff.
I didn't understand that to where to copy this file and what to remove?

Last edited by cli; 11-12-2014 at 01:42 AM.
 
Old 11-12-2014, 01:58 AM   #7
timl
Member
 
Registered: Jan 2009
Location: Sydney, Australia
Distribution: Fedora,CentOS
Posts: 581

Rep: Reputation: 126Reputation: 126
Quote:
And a copy of /sbin/ifconfig would be helpful. Again, remove all sensitive stuff.
I didn't understand that to where to copy this file and what to remove?
Just type

Quote:
/sbin/ifconfig
and you should see your IP information - pls post that. As above, it is a good idea to remove the MAC/HW address.

Quote:
But this static IP will be often changing to DHCP IP automatically
How do you know this is happening? I assume you expect to see the address 192.168.0.37 all the time?
 
1 members found this post helpful.
Old 11-12-2014, 02:28 AM   #8
cli
Member
 
Registered: Apr 2013
Distribution: RedHat, Cent, Ubuntu
Posts: 80

Original Poster
Rep: Reputation: Disabled
Quote:
Originally Posted by timl View Post
Just type
and you should see your IP information - pls post that. As above, it is a good idea to remove the MAC/HW address.
Code:
$ /sbin/ifconfig 
eth0      Link encap:Ethernet  HWaddr xx:yy:zz:12:34:56  
          inet addr:192.168.0.37  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: ab01::cde3:4fgh:ij5k:lmn6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1349494661 errors:0 dropped:0 overruns:0 frame:0
          TX packets:738307664 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:2032536610208 (1.8 TiB)  TX bytes:53674301901 (49.9 GiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:55654 errors:0 dropped:0 overruns:0 frame:0
          TX packets:55654 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:8670677 (8.2 MiB)  TX bytes:8670677 (8.2 MiB)

virbr0    Link encap:Ethernet  HWaddr xx:yy:zz:01:23:45
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)
Quote:
How do you know this is happening? I assume you expect to see the address 192.168.0.37 all the time?
I know this is happenning and that is why I came to here and expecting your help.
I execute "ifconfig" command, in that result my IP will be 192.168.0.245 or 192.168.0.253 or sometime someother IP. There is no any specific time for that to change into dhcp IP. Sometime my static IP will be fine for more than 2-3 days and sometime it will be changing everyday. So this is what I wanted to know whether anybody intentionally attacking to my PC. Now I have renamed below files also,
Code:
/sbin/dhclient to /sbin/dhclient.orig
/sbin/dhclient-script to /sbin/dhclient-script.orig

Last edited by cli; 11-12-2014 at 02:30 AM.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
How to STOP changing of wallpapers automatically on DHCP on Ubuntu OS naveen_cs321 Ubuntu 3 10-09-2013 02:57 PM
Linux (2.6.32-220) networking bridge not receiving DHCP address automatically maccas17 Linux - Networking 1 05-21-2012 05:18 AM
Automatically renew DHCP address on RHEL4 Mark_667 Red Hat 5 03-27-2008 05:14 PM
How to automatically add an address to the address book in Thunderbird royeo Linux - Newbie 2 09-04-2006 04:51 PM
Changing server IP address from DHCP not working khooke Linux - Networking 3 09-25-2005 10:00 AM


All times are GMT -5. The time now is 02:48 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration