LinuxQuestions.org
Latest LQ Deal: Linux Power User Bundle
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Server
User Name
Password
Linux - Server This forum is for the discussion of Linux Software used in a server related context.

Notices


Reply
  Search this Thread
Old 02-14-2014, 01:56 PM   #1
sc2001
LQ Newbie
 
Registered: Aug 2011
Posts: 5

Rep: Reputation: Disabled
DHCP unknow station...


Hello

Please help me :-)
In my network I have one dedicated dhcpd server (based on gentoo).
But 1 month ago I discovered station/device/whatever (?) in my dhpcd log:

Quote:
dhcpd: DHCPDISCOVER from 00:1e:37:d6:2b:1e via eth1: network 192.168.12.0/24: no free leases
I didn't found which device is responsible for.
I check flow on switches etc. I added this mac to dhcpd. But nothing packed to host... In logs I have:
Quote:
dhcpd: DHCPDISCOVER from 00:1e:37:d6:2b:1e via eth1
dhcpd: DHCPOFFER on 192.168.12.249 to 00:1e:37:d6:2b:1e via eth1
and nothing happened more.. No PACK. I suppose that maybe phisical link is broken hmmm.

Do You have any suggest for me? How I can find it?
Part of this mac "00:1e:37" belong to Cisco... But I see on the net, that also to others devices...

With regards
Mc
 
Old 02-15-2014, 03:20 AM   #2
business_kid
LQ Guru
 
Registered: Jan 2006
Location: Ireland
Distribution: Slackware & Android
Posts: 9,247

Rep: Reputation: 968Reputation: 968Reputation: 968Reputation: 968Reputation: 968Reputation: 968Reputation: 968Reputation: 968
dhcpd: DHCPDISCOVER from 00:1e:37:d6:2b:1e via eth1: network 192.168.12.0/24: no free leases

That could mean that you had allocated however many leases(connections) you allow the dhcp server to create, or that other security settings didn't allow the ip range you have allowed the dhcp server to use.

If you want it logging on, check how many boxes were in fact using your service at the time.
I would also grep the logs for that mac address to see how it was treated any other time it requested an IP
 
Old 02-15-2014, 05:27 AM   #3
sc2001
LQ Newbie
 
Registered: Aug 2011
Posts: 5

Original Poster
Rep: Reputation: Disabled
Question

Hello :-),
I know what does it mean. But I have a range about 253 hosts (cidr 24) and only about 100 ip's is reserved at this moment.
I check leases file for it, and see in logs many hosts which are gained new ip after "00:1e:37:d6:2b:1e" entry.
I also created (& separated) new network on eth1 with new dhcpd configuration and big range on this iface, and still the same.

Any new suggest?
Mc
 
Old 02-15-2014, 11:49 AM   #4
business_kid
LQ Guru
 
Registered: Jan 2006
Location: Ireland
Distribution: Slackware & Android
Posts: 9,247

Rep: Reputation: 968Reputation: 968Reputation: 968Reputation: 968Reputation: 968Reputation: 968Reputation: 968Reputation: 968
253 hosts, only 100 IPs - it figures.

give out short leases. There are ways around that problem but without understanding your security/logging requirements I wouldn't make suggestions.
 
Old 02-17-2014, 01:29 AM   #5
sc2001
LQ Newbie
 
Registered: Aug 2011
Posts: 5

Original Poster
Rep: Reputation: Disabled
Angry

Quote:
Originally Posted by business_kid View Post
253 hosts, only 100 IPs - it figures.

give out short leases. There are ways around that problem but without understanding your security/logging requirements I wouldn't make suggestions.
Hello again,
Short leases was done and nothing was changed...
My dhcpd.conf:

Quote:
authoritative;
ddns-update-style none;
lease-file-name "/var/log/dhcpd.leases";
log-facility local7;

subnet 192.168.12.0 netmask 255.255.255.0 {
option domain-name-servers 192.168.12.1, 192.168.12.4;
option netbios-node-type 8;
option netbios-name-servers 192.168.12.1;
option domain-name "intranet";
option nis-domain "intranet";
option subnet-mask 255.255.255.0;
option broadcast-address 192.168.12.255;
option routers 192.168.12.4;
default-lease-time 43200;
max-lease-time 57600;
min-lease-time 43200;
range 192.168.12.20 192.168.12.254;
Hmm I haven't any new idea about it...
Mc
 
Old 02-17-2014, 09:40 AM   #6
psycroptic
Member
 
Registered: Aug 2011
Location: USA
Distribution: ArchLinux - 3.0 kernel
Posts: 342

Rep: Reputation: Disabled
what does /var/log/dhcpd.leases look like? this file has all the currently taken leases, it sounds like it's full. you can edit this file & remove any of the "leases {}" sections if you're sure that host is not on your network anymore/doesn't need the lease anymore. also you probably are aware, but you have a range of .20-.254 giving you 234 usable addresses for the DHCP server to hand out.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
What the reason of this unknow symbol RickCheung Linux - Virtualization and Cloud 3 12-01-2012 03:27 AM
DHCP, Proxy Arp on wifi client station bridge DoDo1975 Linux - Wireless Networking 0 05-22-2007 01:34 PM
mount harddisk with unknow fs datbenik Linux - Hardware 2 12-23-2005 01:11 PM
unknow monitor!!!!! vito_huang Red Hat 3 12-11-2004 09:31 PM
unknow user???? slack66 Linux - Security 7 11-24-2004 06:03 PM

LinuxQuestions.org > Forums > Linux Forums > Linux - Server

All times are GMT -5. The time now is 06:59 AM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration