Using arpwatch on my Debian router at home.
Since I upgraded my laptop to 21.04 I am getting multiple emails a day saying that my laptop MAC has a new IP.
On investigation it looks like this is happening when my laptop roams between APs.
It doesn't affect IPv6 [which is a relief because I am pretty sure my SSH sessions would be dropping if my IP address is changing].
From the laptop:
Code:
May 25 12:27:19 lt07 NetworkManager[1030]: <info> [1621942039.6774] dhcp4 (wlp8s0): state changed unknown -> bound, address=192.168.1.41
May 25 12:29:50 lt07 NetworkManager[1030]: <info> [1621942190.5339] policy: set 'tester' (wlp8s0) as default for IPv6 routing and DNS
May 25 12:29:50 lt07 NetworkManager[1030]: <info> [1621942190.5383] policy: set 'tester' (wlp8s0) as default for IPv6 routing and DNS
May 25 12:30:15 lt07 wpa_supplicant[1072]: wlp8s0: WPA: Group rekeying completed with 64:d1:54:b5:9f:2c [GTK=CCMP]
May 25 12:31:18 lt07 NetworkManager[1030]: <info> [1621942278.3334] manager: NetworkManager state is now CONNECTED_SITE
May 25 12:31:18 lt07 NetworkManager[1030]: <info> [1621942278.6315] manager: NetworkManager state is now CONNECTED_GLOBAL
May 25 12:33:39 lt07 wpa_supplicant[1072]: wlp8s0: CTRL-EVENT-SIGNAL-CHANGE above=0 signal=-78 noise=9999 txrate=21700
May 25 12:34:12 lt07 wpa_supplicant[1072]: wlp8s0: SME: Trying to authenticate with d4:ca:6d:e3:a0:ed (SSID='tester' freq=2452 MHz)
May 25 12:34:12 lt07 NetworkManager[1030]: <info> [1621942452.6829] device (wlp8s0): supplicant interface state: completed -> authenticating
May 25 12:34:12 lt07 wpa_supplicant[1072]: wlp8s0: CTRL-EVENT-REGDOM-CHANGE init=CORE type=WORLD
May 25 12:34:12 lt07 NetworkManager[1030]: <info> [1621942452.6830] device (p2p-dev-wlp8s0): supplicant management interface state: completed -> authenticating
May 25 12:34:12 lt07 NetworkManager[1030]: <info> [1621942452.6831] device (wlp8s0): DHCPv4 lease renewal requested
May 25 12:34:12 lt07 NetworkManager[1030]: <info> [1621942452.6842] dhcp4 (wlp8s0): canceled DHCP transaction
May 25 12:34:12 lt07 NetworkManager[1030]: <info> [1621942452.6842] dhcp4 (wlp8s0): state changed bound -> done
May 25 12:34:12 lt07 NetworkManager[1030]: <info> [1621942452.6847] dhcp4 (wlp8s0): activation: beginning transaction (timeout in 45 seconds)
May 25 12:34:12 lt07 wpa_supplicant[1072]: wlp8s0: Trying to associate with d4:ca:6d:e3:a0:ed (SSID='tester' freq=2452 MHz)
May 25 12:34:12 lt07 NetworkManager[1030]: <info> [1621942452.6859] device (wlp8s0): supplicant interface state: authenticating -> associating
May 25 12:34:12 lt07 NetworkManager[1030]: <info> [1621942452.6860] device (p2p-dev-wlp8s0): supplicant management interface state: authenticating -> associating
May 25 12:34:12 lt07 wpa_supplicant[1072]: wlp8s0: Associated with d4:ca:6d:e3:a0:ed
May 25 12:34:12 lt07 wpa_supplicant[1072]: wlp8s0: CTRL-EVENT-SUBNET-STATUS-UPDATE status=0
May 25 12:34:12 lt07 NetworkManager[1030]: <info> [1621942452.7028] device (wlp8s0): supplicant interface state: associating -> 4way_handshake
May 25 12:34:12 lt07 NetworkManager[1030]: <info> [1621942452.7028] device (p2p-dev-wlp8s0): supplicant management interface state: associating -> 4way_handshake
May 25 12:34:12 lt07 wpa_supplicant[1072]: wlp8s0: WPA: Key negotiation completed with d4:ca:6d:e3:a0:ed [PTK=CCMP GTK=CCMP]
May 25 12:34:12 lt07 wpa_supplicant[1072]: wlp8s0: CTRL-EVENT-CONNECTED - Connection to d4:ca:6d:e3:a0:ed completed [id=0 id_str=]
May 25 12:34:12 lt07 NetworkManager[1030]: <info> [1621942452.7143] device (wlp8s0): supplicant interface state: 4way_handshake -> completed
May 25 12:34:12 lt07 NetworkManager[1030]: <info> [1621942452.7147] device (p2p-dev-wlp8s0): supplicant management interface state: 4way_handshake -> completed
May 25 12:34:12 lt07 wpa_supplicant[1072]: wlp8s0: CTRL-EVENT-SIGNAL-CHANGE above=1 signal=-32 noise=9999 txrate=150000
May 25 12:34:18 lt07 NetworkManager[1030]: <info> [1621942458.3955] dhcp4 (wlp8s0): state changed unknown -> bound, address=192.168.1.48
From the router:
Code:
May 25 12:27:19 togre dhcpd[2605979]: DHCPACK on 192.168.1.41 to d0:7e:35:3a:12:f4 (lt07) via br0
May 25 12:34:14 togre dhcpd[2605979]: DHCPDISCOVER from d0:7e:35:3a:12:f4 (lt07) via br0
May 25 12:34:17 togre dhcpd[2605979]: DHCPDISCOVER from d0:7e:35:3a:12:f4 via br0
May 25 12:34:18 togre dhcpd[2605979]: DHCPOFFER on 192.168.1.48 to d0:7e:35:3a:12:f4 (lt07) via br0
May 25 12:34:18 togre dhcpd[2605979]: DHCPREQUEST for 192.168.1.48 (192.168.1.3) from d0:7e:35:3a:12:f4 (lt07) via br0
May 25 12:34:18 togre dhcpd[2605979]: DHCPACK on 192.168.1.48 to d0:7e:35:3a:12:f4 (lt07) via br0
May 25 12:34:19 togre arpwatch[1192276]: changed ethernet address 192.168.1.48 d0:7e:35:3a:12:f4 (b8:d4:e7:30:4e:c0) br0
From this I can see that the client is sending two DHCPDISCOVERs 3s apart, maybe that explains why it gets a different v4 IP?
Also, the second one doesn't include a hostname. Don't know if that is significant