LinuxQuestions.org

LinuxQuestions.org (/questions/)
-   Linux - Newbie (https://www.linuxquestions.org/questions/linux-newbie-8/)
-   -   IP address automatically changing to DHCP (https://www.linuxquestions.org/questions/linux-newbie-8/ip-address-automatically-changing-to-dhcp-4175520035/)

cli 09-25-2014 09:47 AM

IP address automatically changing to DHCP
 
Hi All,
I am using CentOS-6.5 and configured static IP using NetworkManger(GUI). But this static IP will be often changing to DHCP IP automatically. This is happening since past couple of weeeks and still I couldn't find out the issue. I also tried below ipables rules block dhcp offer but no luck and still it is changing itself to DHCP but there is no any specific time for that(to get DHCP IP).
Code:

iptables -I INPUT 1 -p udp --dport 67:68 --sport 67:68 -j DROP
iptables -I OUTPUT 1 -p udp --dport 67:68 --sport 67:68 -j DROP

if I check the log(/var/log/messages) I found and entry related to dhcp as from 0.0.0.0.
So I am suspecting that anybody trying to gain access to my PC with such spoofed IPs or any daemon is changing to DHCP IP.
Expecting your kind help.

chrism01 09-26-2014 03:57 AM

1. turn off Network Mgr; its a pain in the ....
Code:

chkconfig NetworkManager off
2. check/edit the relevant ifcg-ethX file eg /etc/sysconfig/network-scripts/ifcfg-eth0 and
check by running ifconfig to see which ethX is being used
Code:

ONBOOT=yes
NM_CONTROLLED=no
BOOTPROTO=static

3. Also, check your dhcp server for your MAC address and ensure its not set to receive a dhcp assigned IP.
See examples http://www.linuxtopia.org/online_boo...ml#config-file


... and yes, that all applies to Centos6.x as much as it does v5.x

cli 09-26-2014 10:48 AM

Guru,
No, It did not help even after the static IP, service NetworkManager stop; chkconfig NetworkManager off. Also there is no DHCP reservation in the server side for my PC. So is there any other way that I can completely block dhcp request to my PC. Also request you to check the above mentioned IP Tables rules are correct to block dhcp IP.

cli 11-11-2014 10:41 PM

Hi All,
Still I am facing the same problem, can anybody please suggest how can I completely block dhcp request. Because of this the many downloads(copying backup files using scp) from servers are terminating in the middle and then again I am deleting those incompleted scp files and restarting the downloads. I have already updated the packages using "yum update" command.
Excepting your kind help, I am using CentOS release 6.5 (Final) 64 bit O/S.

timl 11-11-2014 11:23 PM

assuming you are using eth0 could you pls dump the contents of /etc/sysconfig/network-scripts/ifcfg-eth0?

Best to remove MAC add and anything sensitive.

And a copy of /sbin/ifconfig would be helpful. Again, remove all sensitive stuff.

Cheers

cli 11-12-2014 12:38 AM

Hi timl,
Thanks for the reply.
Code:

assuming you are using eth0 could you pls dump the contents of /etc/sysconfig/network-scripts/ifcfg-eth0?

Here is contents of that file.
# cat /etc/sysconfig/network-scripts/ifcfg-eth0
DEVICE=eth0
TYPE=Ethernet
UUID=38b32f16-e22c-4d41-bea6-cff7c1e6ded5
ONBOOT=yes
NM_CONTROLLED=no
BOOTPROTO=static
DEFROUTE=yes
IPV4_FAILURE_FATAL=yes
IPV6INIT=no
#NAME="System eth0"
HWADDR=xx:yy:zz:12:34:56 # original mac has been removed.
IPADDR=192.168.0.37
PREFIX=24
GATEWAY=192.168.0.1
DNS1=192.168.0.100
DNS2=192.168.0.1
DOMAIN=mylocaldomain.com
#LAST_CONNECT=1411126879

Code:

Best to remove MAC add and anything sensitive.
Pls let me know what all the minimal entries are enough in this file.

Code:

And a copy of /sbin/ifconfig would be helpful. Again, remove all sensitive stuff.
I didn't understand that to where to copy this file and what to remove?


timl 11-12-2014 12:58 AM

Quote:

And a copy of /sbin/ifconfig would be helpful. Again, remove all sensitive stuff.
I didn't understand that to where to copy this file and what to remove?
Just type

Quote:

/sbin/ifconfig
and you should see your IP information - pls post that. As above, it is a good idea to remove the MAC/HW address.

Quote:

But this static IP will be often changing to DHCP IP automatically
How do you know this is happening? I assume you expect to see the address 192.168.0.37 all the time?

cli 11-12-2014 01:28 AM

Quote:

Originally Posted by timl (Post 5268548)
Just type
and you should see your IP information - pls post that. As above, it is a good idea to remove the MAC/HW address.

Code:

$ /sbin/ifconfig
eth0      Link encap:Ethernet  HWaddr xx:yy:zz:12:34:56 
          inet addr:192.168.0.37  Bcast:192.168.0.255  Mask:255.255.255.0
          inet6 addr: ab01::cde3:4fgh:ij5k:lmn6/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:1349494661 errors:0 dropped:0 overruns:0 frame:0
          TX packets:738307664 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:2032536610208 (1.8 TiB)  TX bytes:53674301901 (49.9 GiB)

lo        Link encap:Local Loopback 
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:16436  Metric:1
          RX packets:55654 errors:0 dropped:0 overruns:0 frame:0
          TX packets:55654 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:8670677 (8.2 MiB)  TX bytes:8670677 (8.2 MiB)

virbr0    Link encap:Ethernet  HWaddr xx:yy:zz:01:23:45
          inet addr:192.168.122.1  Bcast:192.168.122.255  Mask:255.255.255.0
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

Quote:

How do you know this is happening? I assume you expect to see the address 192.168.0.37 all the time?
I know this is happenning and that is why I came to here and expecting your help.
I execute "ifconfig" command, in that result my IP will be 192.168.0.245 or 192.168.0.253 or sometime someother IP. There is no any specific time for that to change into dhcp IP. Sometime my static IP will be fine for more than 2-3 days and sometime it will be changing everyday. So this is what I wanted to know whether anybody intentionally attacking to my PC. Now I have renamed below files also,
Code:

/sbin/dhclient to /sbin/dhclient.orig
/sbin/dhclient-script to /sbin/dhclient-script.orig



All times are GMT -5. The time now is 06:33 PM.