Two minor DHCP questions

shavano · Mar 23, 2006, 3:50 AM

I think I read all the FAQ, all the Wiki and all the DHCP section here. Didn't find the answer to these:

1. what does the online/offline parameter in the Diagnostics: DHCP Leases page mean? It doesn't mean the lease has expired or been released because I can ping some of the "offline" hosts. Is it derived from the state table, i.e. no state update from that host in X minutes and it's marked offline? If so, how long is X?

2. Several of the hosts pretty consistently get duplicate entries in dhcpd.leases – exact duplicates: same IP, same Mac, same start/end, same UID ... everything. Is it that the DHCP service writes a record to the lease file for every ACK it issues and these clients are issuing back-to-back REQUESTs. The culprits are all Windows systems. My Macs don't do it.

Leoandru · Mar 23, 2006, 1:26 PM

@shavano:

I think I read all the FAQ, all the Wiki and all the DHCP section here. Didn't find the answer to these:

1. what does the online/offline parameter in the Diagnostics: DHCP Leases page mean? It doesn't mean the lease has expired or been released because I can ping some of the "offline" hosts. Is it derived from the state table, i.e. no state update from that host in X minutes and it's marked offline? If so, how long is X?

2. Several of the hosts pretty consistently get duplicate entries in dhcpd.leases – exact duplicates: same IP, same Mac, same start/end, same UID ... everything. Is it that the DHCP service writes a record to the lease file for every ACK it issues and these clients are issuing back-to-back REQUESTs. The culprits are all Windows systems. My Macs don't do it.

1. online - the computer which attained the lease was last seen online within the last x minutes. I'm not sure sure what x minutes is and I think its derived from the address translation table. offline line means just that, no activity from host within x minutes.

2. I'm not sure why it does that. maybe you need to look for detailed info on dhcpd operations. I know its nothing to worry about though. dhcpd keeps appending info to the lease file every time it needs to update a lease, you'll see several entries in the file for one of your macs if you release and renew its ip address.

shavano · Mar 23, 2006, 3:20 PM

On the dup leases, it showed up for my G5 when I woke it this morning. The pfSense log file shows only one REQUEST and only one ACK for it so it doesn't make sense why there there were two entries in dhcpd.leases.

So, I was wrong before: it does sometimes occur with my Macs. Three systems (two Macs, one Win2k) this morning show dup leases in the pfSense GUI and leases file, but each only has one set of REQUEST/ACK in the log file.

Oh well, not an operational problem, just irritating.

Leoandru · Mar 23, 2006, 4:29 PM

Although the lease file has several duplicated entries, Status -> Dhcp Lease from gui should only show the most current lease per address (assuming your using the latest snapshot), which was the last lease appended to file by dhcpd. Clicking on show all configured leases will show you all those duplicated lease file entries.

shavano · Mar 23, 2006, 5:25 PM

I'm using Beta2, not the latest snapshot, but Beta2 is pretty new.

On the Status -> DHCP Leases page, both the "Show all" and "Show active" are identical and show the duplicated entries. This matches exactly what is in /var/dhcpd/var/db/dhcpd.leases.

However, it does get pruned occasionally by something. Two of the duplicates that were there earlier this morning are now gone but their expiration time had not passed – I had set it for 24 hours.

sullrich · Mar 23, 2006, 5:33 PM

Upgrade to the latest snapshot. Its MUCH newer than beta2 and includes the fixes just as leo pointed out.

shavano · Mar 23, 2006, 9:08 PM

I would need an embedded version – don't see that on the mirrors, just "full-update".

Is this one in your directory the latest?

~sullrich/RELENG_1_SNAPSHOT_03-19-2006/pfSense.img.gz

hoba · Mar 23, 2006, 9:10 PM

yes, that's the one.

shavano · Mar 24, 2006, 2:57 PM

The March 19 snapshot fixed the pfSense display. Thanks!

Of course, the dhcpd.leases file still has the duplicate entries, but I just checked with Ethereal to be sure: one REQUEST, one ACK from my PC, two indentical records in the lease file. I assume that's a dhcpd quirk and that you guys haven't modified it.

So, do I understand this correctly: on emmbedded images everything under /var is on the memory filesystem except for /var/dhcpd/dev, meaning the leases are written to the mfs? (So I could go back to the default 2-hour lease without concern for the CF?)

sullrich · Mar 24, 2006, 3:40 PM

/var is a memory disk. /var/dhcpd/dev is a devfs mount.