What does DHCPRELEASE ... (not found) mean?

pfpv

I run a DHCP server on pfSense 22.05. It's very restrictive. I left a range of only 3 IPs and I have static mappings for all my devices. I don't bring random devices into my network, so those 3 are never used and are not allowed to be used because I also enabled Static ARP entries. Each static entry has "Create an ARP Table Static Entry for this MAC & IP Address pair" checked.

Today I noticed that my Ecobee thermostat was offline. I checked it and found that it had a 169.x.x.x IP. It looked like it couldn't get an IP. I checked the pfSense log and found such an entry for it:

Aug 20 10:34:42 dhcpd 22774 DHCPRELEASE of IP from MAC via igb1 (not found)

There were no other entries for this device around that time. Other DHCP logs for it were normal, renewing IP every 12 hr per my settings. I disabled/re-enabled WiFi on it and it reconnected normally getting its IP.

I searched the log for other (not found) entries and found another one - for a webcam:

Aug 20 18:35:57 dhcpd 22774 DHCPACK on IP to MAC via igb1
Aug 20 18:35:57 dhcpd 22774 DHCPREQUEST for IP from MAC via igb1
Aug 20 18:35:57 dhcpd 22774 DHCPRELEASE of IP from MAC via igb1 (not found)

But at the same second the IP was renewed. I searched the log for DHCPRELEASE and those were the only two entries in roughly two days. I've never seen/noticed DHCPRELEASE in my DHCP server logs before but I never looked for it. I also never found disconnected devices before. This is new for me.

Can anyone please explain what this "not found" means for a static entry and why I saw DHCPRELEASE? I couldn't find much info by googling. I found this statement: "The DHCPRELEASE (not found) message is easy enough to guess - there's no entry in the leases file to release." But I don't understand how it's possible when that device renewed its IP before on time and it wasn't time for renewal. And why DHCPRELEASE?

johnpoz

@pfpv if it tried to release the 169.254.x.x address which an IP it will give itself when it couldn't get an IP from dhcp, that IP wouldn't be found to be released.

https://wiki.wireshark.org/APIPA.md

pfpv

@johnpoz thanks, but it doesn't make sense because the IP was its IP on my LAN, not the APIPA IP. I replaced IPs and MACs in the log when I posted. Do you know why a device would release an IP all of a sudden? It wasn't even time for renewal. It renewed its IP at 4:07 and it was up for renewal at 16:07. This DHCPRELEASE happened at 10:34.

The same was for the webcam (second example). DHCPRELEASE of its IP assigned by the DHCP server. But in this case it was time for renewal and it was renewed the same second.

Those IPs should not have been "not found". They were assigned by the DHCP server.

johnpoz

@pfpv you need to understand the dhcp process its quite possible for a client to send a dhcp release. And normal for that to happen.

If client sent it more than once, or just for for IP that was not in the lease table then the dhcp server could make an log entry that its not found, etc.

I wouldn't be too worried about those log entries - what I would be concerned with is if the client is having an issue getting an IP from dhcp server, and giving itself a 169.254 address - this points to the dhcp server not running at the time, or connectivity issues, etc.

pfpv

@johnpoz I really don't understand why Ecobee or any other device would send DHCPRELEASE. It's not even mandatory in the protocol.

I wonder more about the (not found) part. The entries were like this:

Aug 20 10:34:42 	dhcpd 	22774 	DHCPRELEASE of 192.168.0.43 from 44:61:32:xx:xx:xx via igb1 (not found) 
Aug 20 18:35:57 	dhcpd 	22774 	DHCPRELEASE of 192.168.0.127 from xx:xx:xx:xx:xx:xx via igb1 (not found)

Those IPs are in the DHCP Static Mappings for this Interface.