Results 1 to 2 of 2

Thread: Duplicate offer and ack entries in DHCP log

  1. #1
    Join Date
    Oct 2014
    Location
    Columbia Mo
    Beans
    Hidden!
    Distro
    Ubuntu 18.04 Bionic Beaver

    Duplicate offer and ack entries in DHCP log

    This happens for all clients.
    The dhcp server is authoritative and mac filtered.
    Any Ideas as to why this is occurring?
    Below is an example.

    Oct 31 17:57:50 server2 dhcpd: DHCPINFORM from 10.10.2.8 via eth0
    Oct 31 17:57:50 server2 dhcpd: DHCPINFORM from 10.10.2.8 via eth0
    Oct 31 17:57:50 server2 dhcpd: DHCPACK to 10.10.2.8 (00:15:00:1b:73:cd) via eth0
    Oct 31 17:57:50 server2 dhcpd: DHCPACK to 10.10.2.8 (00:15:00:1b:73:cd) via eth0

  2. #2
    Join Date
    Feb 2011
    Location
    Coquitlam, B.C. Canada
    Beans
    3,506
    Distro
    Ubuntu Development Release

    Re: Duplicate offer and ack entries in DHCP log

    I saw your other same thread on this, and your bump. I looked into it for awhile, but I don't know... However, I am surprised by the order of the log entries as I would have expected this:
    Code:
    Oct 31 17:57:50 server2 dhcpd: DHCPINFORM from 10.10.2.8 via eth0 
    Oct 31 17:57:50 server2 dhcpd: DHCPACK to 10.10.2.8 (00:15:00:1b:73:cd) via eth0 
    Oct 31 17:57:50 server2 dhcpd: DHCPINFORM from 10.10.2.8 via eth0 
    Oct 31 17:57:50 server2 dhcpd: DHCPACK to 10.10.2.8 (00:15:00:1b:73:cd) via eth0
    I.E I would have expected the log entires to be in the order of fetched and dealt with by the daemon. Here is a similar example from my server. Note how the log entries are in the daemon processed order and the actual packets, captured with tcpdump, are in a different order. (there is a one hour time offset between the two logs, something I have never bothered to fix):
    Code:
    Oct 31 11:18:11 doug-64 dhcpd: DHCPREQUEST for 192.168.111.106 from 00:23:6c:8a:a3:bc via eth0
    Oct 31 11:18:11 doug-64 dhcpd: DHCPACK on 192.168.111.106 to 00:23:6c:8a:a3:bc via eth0
    Oct 31 11:18:11 doug-64 dhcpd: DHCPREQUEST for 192.168.111.106 from 00:23:6c:8a:a3:bc via eth0
    Oct 31 11:18:11 doug-64 dhcpd: DHCPACK on 192.168.111.106 to 00:23:6c:8a:a3:bc via eth0
    Oct 31 11:18:15 doug-64 dhcpd: DHCPDISCOVER from 00:23:6c:8a:a3:bc via eth0
    Oct 31 11:18:15 doug-64 dhcpd: DHCPOFFER on 192.168.111.106 to 00:23:6c:8a:a3:bc via eth0
    Code:
    2014-10-31 10:18:11.119956 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:23:6c:8a:a3:bc, length 300
    2014-10-31 10:18:11.120013 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:23:6c:8a:a3:bc, length 300
    2014-10-31 10:18:11.120142 IP 192.168.111.1.67 > 192.168.111.106.68: BOOTP/DHCP, Reply, length 300
    2014-10-31 10:18:11.120213 IP 192.168.111.1.67 > 192.168.111.106.68: BOOTP/DHCP, Reply, length 300
    2014-10-31 10:18:15.397896 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:23:6c:8a:a3:bc, length 300
    2014-10-31 10:18:15.398092 IP 192.168.111.1.67 > 192.168.111.106.68: BOOTP/DHCP, Reply, length 300
    For your case, I wonder if there are duplicate log entries, or some other odd thing. I would suggest to monitor things with tcpdump and correlate with the log file, and go from there.
    Code:
    sudo tcpdump -n -tttt -i eth0 port 67 and port 68
    Any follow-up information on your issue would be appreciated. Please have the courtesy to report back.

Tags for this Thread

Bookmarks

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •