Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Strange address Shown in the dhcp leases

    Scheduled Pinned Locked Moved General pfSense Questions
    57 Posts 12 Posters 14.1k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • F Offline
      firefox
      last edited by

      So your sure its showing up on your lan interface?  Or your just seeing it hit your dhcp server?

      i see it on the DHCP leases not in the dhcp server

      Why don't you sniff for the bootp packets..  This might give you some better clue to what the device in the details of the packet.

      how do i do that ?

      So can not ping, but it arps??  So when you try and ping that IP, and you look in your arp table you see it?

      no cant see it in the arp

      there are all the options

      Running: /usr/local/bin/nmap  -sP -PR '192.168.0.43'
      Starting Nmap 6.40 ( http://nmap.org ) at 2015-06-16 17:03 IDT
      Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
      Nmap done: 1 IP address (0 hosts up) scanned in 0.52 seconds
      
      Running: /usr/local/bin/nmap  -sS -P0 -sV -O '192.168.0.43'
      Starting Nmap 6.40 ( http://nmap.org ) at 2015-06-16 17:04 IDT
      Nmap done: 1 IP address (0 hosts up) scanned in 2.95 seconds
      
      Running: /usr/local/bin/nmap  -sT '192.168.0.43'
      Starting Nmap 6.40 ( http://nmap.org ) at 2015-06-16 17:05 IDT
      Note: Host seems down. If it is really up, but blocking our ping probes, try -Pn
      Nmap done: 1 IP address (0 hosts up) scanned in 0.49 seconds
      
      Running: /usr/local/bin/nmap  -sS -P0 -sV -O '192.168.0.43'
      Starting Nmap 6.40 ( http://nmap.org ) at 2015-06-16 17:06 IDT
      Nmap done: 1 IP address (0 hosts up) scanned in 2.07 seconds
      
      

      So no real AP, or smart switch - tracking down something like this can be tricky.. If you had a smart switch and real AP you could see where the mac is listed on physical port and what macs are trying to associate to your AP..

      the cisco is real access point

      So is your wireless open, or secured

      my wireless is secured

      If still happens could be one of your routers acting as AP..

      my routers  are acting as AP as i said

      Do you run any sort of visualization.. How did you check for the mac exactly on all your devices?

      i went to every computer and tv and printer and lap top
      and check (i go to setting Depending on the device And saw the mac address)

      ![home.plex - Status DHCP leases - 2015-06-16_17.10.12.png](/public/imported_attachments/1/home.plex - Status DHCP leases - 2015-06-16_17.10.12.png)
      ![home.plex - Status DHCP leases - 2015-06-16_17.10.12.png_thumb](/public/imported_attachments/1/home.plex - Status DHCP leases - 2015-06-16_17.10.12.png_thumb)
      ![home.plex - Diagnostics ARP Table - 2015-06-16_17.16.50.png](/public/imported_attachments/1/home.plex - Diagnostics ARP Table - 2015-06-16_17.16.50.png)
      ![home.plex - Diagnostics ARP Table - 2015-06-16_17.16.50.png_thumb](/public/imported_attachments/1/home.plex - Diagnostics ARP Table - 2015-06-16_17.16.50.png_thumb)
      ![Cisco IOS Series AP - 2015-06-16_17.18.38.png](/public/imported_attachments/1/Cisco IOS Series AP - 2015-06-16_17.18.38.png)
      ![Cisco IOS Series AP - 2015-06-16_17.18.38.png_thumb](/public/imported_attachments/1/Cisco IOS Series AP - 2015-06-16_17.18.38.png_thumb)

      1 Reply Last reply Reply Quote 0
      • johnpozJ Offline
        johnpoz LAYER 8 Global Moderator
        last edited by

        diag, packet capture will allow you to sniff..  Pick your lan interface, UDP and either port 67 or 68 since these are the ports bootp/dhcp will be on.

        Let it run until you see the lease show up with that weird mac in it, if you have a lot of dhcp on your network then you might need to change the 100 packet limit to 0 or something greater to catch the packets.

        Then download it and check it wireshark.

        example see attached - you can validate the discover is from the odd ball mac, and then look into the details of the packet and you might get some info that helps you identify what is actually asking for ip.

        If you can not see it in arp, your not going to be able to nmap scan it.  Turn off your other AP, do you still get it - then look in the AP for associated clients..  If you change your psk, would seem unlikely the device could associate with your wireless and get an IP..  So either its an actual AP device asking for it, or something wired.

        So are any of your machines running any visualization software?

        dhcpexample.png
        dhcpexample.png_thumb

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 25.07 | Lab VMs 2.8, 25.07

        1 Reply Last reply Reply Quote 0
        • F Offline
          firefox
          last edited by

          diag, packet capture will allow you to sniff..  Pick your lan interface, UDP and either port 67 or 68 since these are the ports bootp/dhcp will be on.

          Let it run until you see the lease show up with that weird mac in it, if you have a lot of dhcp on your network then you might need to change the 100 packet limit to 0 or something greater to catch the packets.

          you mean this in the image ?

          ![Screenshot from 2015-06-16 18:30:45.png](/public/imported_attachments/1/Screenshot from 2015-06-16 18:30:45.png)
          ![Screenshot from 2015-06-16 18:30:45.png_thumb](/public/imported_attachments/1/Screenshot from 2015-06-16 18:30:45.png_thumb)

          1 Reply Last reply Reply Quote 0
          • johnpozJ Offline
            johnpoz LAYER 8 Global Moderator
            last edited by

            What??  No diagnostics on your pfsense menu, packet capture.. You don't need to install any package to do sniffs.

            packetcapture.png
            packetcapture.png_thumb

            An intelligent man is sometimes forced to be drunk to spend time with his fools
            If you get confused: Listen to the Music Play
            Please don't Chat/PM me for help, unless mod related
            SG-4860 25.07 | Lab VMs 2.8, 25.07

            1 Reply Last reply Reply Quote 0
            • F Offline
              firefox
              last edited by

              i try it with 67 and 68 port
              and the IP of the Weird mac address

              and i got Nothing

              ![Screenshot from 2015-06-17 07:04:38.png](/public/imported_attachments/1/Screenshot from 2015-06-17 07:04:38.png)
              ![Screenshot from 2015-06-17 07:04:38.png_thumb](/public/imported_attachments/1/Screenshot from 2015-06-17 07:04:38.png_thumb)

              1 Reply Last reply Reply Quote 0
              • johnpozJ Offline
                johnpoz LAYER 8 Global Moderator
                last edited by

                no I would not put in an IP.. If you delete the lease and it asks for a new one doesn't mean it gets one.. Don't put in an IP..

                And how long did you let it run??  Thought you said it could take 16 hour for it to show up??  Did a new lease show up?  After you deleted the current one?

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 25.07 | Lab VMs 2.8, 25.07

                1 Reply Last reply Reply Quote 0
                • F Offline
                  firefox
                  last edited by

                  so i  need to delete the IP from the DHCP leases

                  in the packet capture screen i should leave Host Address Empty
                  in the port Enroll 67

                  and let it run

                  Then again, with the number 68  ?

                  1 Reply Last reply Reply Quote 0
                  • johnpozJ Offline
                    johnpoz LAYER 8 Global Moderator
                    last edited by

                    Make sure you put in UDP and either port 67 or 68 would work.. see attached

                    Yes I would delete the lease, so you know for sure if it shows up again or not, etc.

                    Depending on how many dhcp clients and how long your default leases are, etc.. You might get some noise..  Which is why should prob set to 0 for how long to capture..  You can check it every few hours stop and download and start it again if you don't see anything in the leases table showing the odd mac…

                    catchdhcpclient.png
                    catchdhcpclient.png_thumb

                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                    If you get confused: Listen to the Music Play
                    Please don't Chat/PM me for help, unless mod related
                    SG-4860 25.07 | Lab VMs 2.8, 25.07

                    1 Reply Last reply Reply Quote 0
                    • F Offline
                      firefox
                      last edited by

                      here is what i got

                      07:41:27.054089 IP 192.168.0.2.68 > 192.168.0.1.67: UDP, length 300
                      07:41:27.055016 IP 192.168.0.1.67 > 192.168.0.2.68: UDP, length 300
                      07:41:48.651588 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      07:41:48.652109 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      07:43:08.613871 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      07:43:08.614325 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      07:45:54.925446 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                      07:45:54.925982 IP 192.168.0.1.67 > 192.168.0.4.68: UDP, length 300
                      07:45:54.926380 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                      07:45:54.926759 IP 192.168.0.1.67 > 192.168.0.4.68: UDP, length 300
                      07:48:26.962366 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 548
                      07:48:26.962959 IP 192.168.0.1.67 > 192.168.0.5.68: UDP, length 300
                      07:48:27.066267 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 548
                      07:48:27.066719 IP 192.168.0.1.67 > 192.168.0.5.68: UDP, length 300
                      07:50:05.596750 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      07:50:05.597353 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      07:51:57.071397 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      07:51:57.071916 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      07:53:16.824087 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      07:53:16.824659 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      07:53:20.743536 IP 192.168.0.3.68 > 192.168.0.1.67: UDP, length 304
                      07:53:20.744155 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      07:54:33.931258 IP 192.168.0.9.68 > 192.168.0.1.67: UDP, length 300
                      07:54:33.931849 IP 192.168.0.1.67 > 192.168.0.9.68: UDP, length 300
                      07:56:09.821016 IP 192.168.0.20.68 > 192.168.0.1.67: UDP, length 309
                      07:56:09.821686 IP 192.168.0.1.67 > 192.168.0.20.68: UDP, length 300
                      07:56:33.847887 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      07:56:33.848379 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      07:57:53.833666 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      07:57:53.834217 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:02:05.442842 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:02:05.443401 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:03:27.643417 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:03:27.643951 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:12:13.849171 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:12:13.849761 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:13:33.775594 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:13:33.776131 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:20:05.567485 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:20:05.568043 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:22:22.243967 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:22:22.244517 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:23:41.833586 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:23:41.834136 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:26:05.416493 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:26:05.417063 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:32:30.648030 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:32:30.648600 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:32:32.898740 IP 192.168.0.4.68 > 192.168.0.1.67: UDP, length 300
                      08:32:32.899307 IP 192.168.0.1.67 > 192.168.0.4.68: UDP, length 300
                      08:33:50.536357 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:33:50.536917 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:37:49.240146 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                      08:37:49.240666 IP 192.168.0.1.67 > 255.255.255.255.68: UDP, length 300
                      08:42:39.040000 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:42:39.040569 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:43:58.654170 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:43:58.654727 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:48:28.080121 IP 192.168.0.5.68 > 192.168.0.1.67: UDP, length 548
                      08:48:28.080843 IP 192.168.0.1.67 > 192.168.0.5.68: UDP, length 300
                      08:50:05.554885 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:50:05.555551 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:52:47.479276 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:52:47.479836 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:53:20.818240 IP 192.168.0.3.68 > 192.168.0.1.67: UDP, length 304
                      08:53:20.818754 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:53:46.880756 IP 192.168.0.20.68 > 192.168.0.1.67: UDP, length 309
                      08:53:46.881354 IP 192.168.0.1.67 > 192.168.0.20.68: UDP, length 300
                      08:54:07.142439 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      08:54:07.142797 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      08:54:33.609691 IP 192.168.0.9.68 > 192.168.0.1.67: UDP, length 300
                      08:54:33.610278 IP 192.168.0.1.67 > 192.168.0.9.68: UDP, length 300
                      09:02:55.877132 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:02:55.877743 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:04:15.551881 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:04:15.552377 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:07:46.335084 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:07:46.335653 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:13:04.276084 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:13:04.276468 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:14:24.525542 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:14:24.525899 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:20:05.550197 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:20:05.550784 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:21:52.704632 IP 192.168.0.4.68 > 192.168.0.1.67: UDP, length 300
                      09:21:52.705172 IP 192.168.0.1.67 > 192.168.0.4.68: UDP, length 300
                      09:23:12.670089 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:23:12.670585 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:24:32.415286 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:24:32.415828 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:33:21.072855 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:33:21.073406 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:34:41.109728 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:34:41.110301 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:43:29.467359 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:43:29.467891 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:44:49.211283 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:44:49.211833 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:48:28.231154 IP 192.168.0.5.68 > 192.168.0.1.67: UDP, length 548
                      09:48:28.231990 IP 192.168.0.1.67 > 192.168.0.5.68: UDP, length 300
                      09:50:05.537824 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:50:05.538376 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:51:23.553493 IP 192.168.0.20.68 > 192.168.0.1.67: UDP, length 309
                      09:51:23.554080 IP 192.168.0.1.67 > 192.168.0.20.68: UDP, length 300
                      09:53:20.871574 IP 192.168.0.3.68 > 192.168.0.1.67: UDP, length 304
                      09:53:20.872260 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:53:37.865908 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:53:37.866398 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      09:54:33.287869 IP 192.168.0.9.68 > 192.168.0.1.67: UDP, length 300
                      09:54:33.288487 IP 192.168.0.1.67 > 192.168.0.9.68: UDP, length 300
                      09:54:57.862903 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      09:54:57.863515 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:03:46.283120 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:03:46.283664 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:05:05.949235 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:05:05.949758 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:08:03.319538 IP 192.168.0.4.68 > 192.168.0.1.67: UDP, length 300
                      10:08:03.320117 IP 192.168.0.1.67 > 192.168.0.4.68: UDP, length 300
                      10:13:54.684832 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:13:54.685372 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:15:14.675016 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:15:14.675594 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:20:05.543198 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:20:05.543722 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:24:03.083377 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:24:03.083929 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:25:22.760226 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:25:22.760767 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:34:11.480468 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:34:11.481002 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:35:31.457918 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:35:31.458471 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:44:19.877148 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:44:19.877663 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:45:39.553264 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:45:39.553851 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:47:44.958617 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:47:44.959155 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:48:28.380912 IP 192.168.0.5.68 > 192.168.0.1.67: UDP, length 548
                      10:48:28.381694 IP 192.168.0.1.67 > 192.168.0.5.68: UDP, length 300
                      10:49:00.456395 IP 192.168.0.20.68 > 192.168.0.1.67: UDP, length 309
                      10:49:00.457117 IP 192.168.0.1.67 > 192.168.0.20.68: UDP, length 300
                      10:50:05.527838 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:50:05.528221 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:51:14.733043 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:51:14.733600 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:53:21.008316 IP 192.168.0.3.68 > 192.168.0.1.67: UDP, length 304
                      10:53:21.008906 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:54:28.310486 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:54:28.311069 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      10:54:32.965674 IP 192.168.0.9.68 > 192.168.0.1.67: UDP, length 300
                      10:54:32.966234 IP 192.168.0.1.67 > 192.168.0.9.68: UDP, length 300
                      10:55:01.786661 IP 192.168.0.4.68 > 192.168.0.1.67: UDP, length 300
                      10:55:01.787255 IP 192.168.0.1.67 > 192.168.0.4.68: UDP, length 300
                      10:55:45.079401 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      10:55:45.079960 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:03:26.212080 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:03:26.212624 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:04:36.686966 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:04:36.687532 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:05:56.245742 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:05:56.246451 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:14:45.113307 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:14:45.113851 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:16:05.040707 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:16:05.041226 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:20:05.516378 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:20:05.516953 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:24:53.515284 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:24:53.515843 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:26:13.339392 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:26:13.339900 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:35:01.915643 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:35:01.916194 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:36:21.908676 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:36:21.909243 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:45:10.306133 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:45:10.306541 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:46:29.993996 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:46:29.994535 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:48:28.529155 IP 192.168.0.5.68 > 192.168.0.1.67: UDP, length 548
                      11:48:28.529993 IP 192.168.0.1.67 > 192.168.0.5.68: UDP, length 300
                      11:49:20.709317 IP 192.168.0.4.68 > 192.168.0.1.67: UDP, length 300
                      11:49:20.709805 IP 192.168.0.1.67 > 192.168.0.4.68: UDP, length 300
                      11:50:05.497282 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:50:05.497807 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:53:21.033106 IP 192.168.0.3.68 > 192.168.0.1.67: UDP, length 304
                      11:53:21.033706 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:54:32.643167 IP 192.168.0.9.68 > 192.168.0.1.67: UDP, length 300
                      11:54:32.643760 IP 192.168.0.1.67 > 192.168.0.9.68: UDP, length 300
                      11:55:18.712633 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:55:18.713190 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      11:56:38.593792 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      11:56:38.594357 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:05:27.107905 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:05:27.108486 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:06:46.673222 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:06:46.673795 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:15:35.517002 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:15:35.517553 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:16:55.431581 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:16:55.432183 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:20:05.480186 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:20:05.480736 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:21:56.992892 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:21:56.993494 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:25:43.910944 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:25:43.911485 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:27:03.618927 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:27:03.619347 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:35:52.312305 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:35:52.312859 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:37:12.207145 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:37:12.207706 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:45:50.109920 IP 192.168.0.4.68 > 192.168.0.1.67: UDP, length 300
                      12:45:50.110549 IP 192.168.0.1.67 > 192.168.0.4.68: UDP, length 300
                      12:46:00.711996 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:46:00.712508 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:47:20.286673 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:47:20.287213 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:48:28.676594 IP 192.168.0.5.68 > 192.168.0.1.67: UDP, length 548
                      12:48:28.677349 IP 192.168.0.1.67 > 192.168.0.5.68: UDP, length 300
                      12:50:05.479071 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:50:05.479627 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:52:00.355134 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 309
                      12:52:00.355758 IP 192.168.0.1.67 > 192.168.0.20.68: UDP, length 300
                      12:52:03.416750 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 309
                      12:52:03.417258 IP 192.168.0.1.67 > 192.168.0.20.68: UDP, length 300
                      12:52:03.432907 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 321
                      12:52:03.433196 IP 192.168.0.1.67 > 192.168.0.20.68: UDP, length 300
                      12:52:40.795670 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 315
                      12:52:40.796256 IP 192.168.0.1.67 > 192.168.0.20.68: UDP, length 300
                      12:53:21.054371 IP 192.168.0.3.68 > 192.168.0.1.67: UDP, length 304
                      12:53:21.055001 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:54:32.320146 IP 192.168.0.9.68 > 192.168.0.1.67: UDP, length 300
                      12:54:32.320755 IP 192.168.0.1.67 > 192.168.0.9.68: UDP, length 300
                      12:56:09.108426 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:56:09.108972 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      12:57:29.013125 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      12:57:29.013510 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:06:17.509257 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      13:06:17.509809 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:07:37.074970 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      13:07:37.075539 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:13:33.975621 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                      13:13:33.976148 IP 192.168.0.1.67 > 192.168.0.8.68: UDP, length 300
                      13:13:33.976583 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                      13:13:33.976933 IP 192.168.0.1.67 > 192.168.0.8.68: UDP, length 300
                      13:16:25.909949 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      13:16:25.910517 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:16:35.316510 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 306
                      13:16:35.317081 IP 192.168.0.1.67 > 192.168.0.21.68: UDP, length 300
                      13:16:35.319411 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 331
                      13:16:35.319809 IP 192.168.0.1.67 > 192.168.0.21.68: UDP, length 300
                      13:16:44.537800 IP 192.168.0.21.68 > 255.255.255.255.67: UDP, length 300
                      13:16:44.538216 IP 192.168.0.1.67 > 192.168.0.21.68: UDP, length 300
                      13:16:45.111824 IP 192.168.0.21.68 > 255.255.255.255.67: UDP, length 300
                      13:16:45.243888 IP 192.168.0.1.67 > 255.255.255.255.68: UDP, length 300
                      13:17:45.775656 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      13:17:45.776196 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:18:57.799971 IP 192.168.0.21.68 > 255.255.255.255.67: UDP, length 300
                      13:18:57.800548 IP 192.168.0.1.67 > 192.168.0.21.68: UDP, length 300
                      13:20:05.468291 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      13:20:05.468765 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:25:20.080699 IP 192.168.0.21.68 > 255.255.255.255.67: UDP, length 300
                      13:25:20.081200 IP 192.168.0.1.67 > 192.168.0.21.68: UDP, length 300
                      13:25:41.836936 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 315
                      13:25:41.837455 IP 192.168.0.1.67 > 192.168.0.20.68: UDP, length 300
                      13:26:34.307335 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      13:26:34.307906 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:27:53.874001 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      13:27:53.874614 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:28:04.842125 IP 192.168.0.21.68 > 255.255.255.255.67: UDP, length 300
                      13:28:04.842620 IP 192.168.0.1.67 > 192.168.0.21.68: UDP, length 300
                      13:34:15.828127 IP 192.168.0.4.68 > 192.168.0.1.67: UDP, length 300
                      13:34:15.828727 IP 192.168.0.1.67 > 192.168.0.4.68: UDP, length 300
                      13:35:34.313016 IP 192.168.0.21.68 > 255.255.255.255.67: UDP, length 300
                      13:35:34.313929 IP 192.168.0.1.67 > 192.168.0.21.68: UDP, length 300
                      13:36:42.711980 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      13:36:42.712899 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:37:04.962874 IP 192.168.0.21.68 > 255.255.255.255.67: UDP, length 300
                      13:37:04.963469 IP 192.168.0.1.67 > 192.168.0.21.68: UDP, length 300
                      13:38:02.580932 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      13:38:02.581482 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:39:11.038115 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                      13:39:11.039013 IP 192.168.0.1.67 > 192.168.0.2.68: UDP, length 300
                      13:39:11.039574 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 300
                      13:39:11.039867 IP 192.168.0.1.67 > 192.168.0.2.68: UDP, length 300
                      13:41:24.505947 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 315
                      13:41:24.506507 IP 192.168.0.1.67 > 192.168.0.20.68: UDP, length 300
                      13:46:51.113635 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      13:46:51.114177 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:48:10.689573 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      13:48:10.690135 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:48:28.823544 IP 192.168.0.5.68 > 192.168.0.1.67: UDP, length 548
                      13:48:28.824304 IP 192.168.0.1.67 > 192.168.0.5.68: UDP, length 300
                      13:50:05.465493 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      13:50:05.466095 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:50:35.570467 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 315
                      13:50:35.571049 IP 192.168.0.1.67 > 192.168.0.20.68: UDP, length 300
                      13:53:21.063493 IP 192.168.0.3.68 > 192.168.0.1.67: UDP, length 304
                      13:53:21.064085 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:54:31.996572 IP 192.168.0.9.68 > 192.168.0.1.67: UDP, length 300
                      13:54:31.997152 IP 192.168.0.1.67 > 192.168.0.9.68: UDP, length 300
                      13:56:39.087543 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      13:56:39.088082 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      13:58:19.085537 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      13:58:19.086006 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:04:58.902448 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:04:58.903038 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:06:11.154299 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:06:11.154864 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:07:27.297234 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:07:27.297777 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:08:38.184971 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:08:38.185500 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:09:05.713460 IP 192.168.0.8.68 > 192.168.0.1.67: UDP, length 300
                      14:09:05.713954 IP 192.168.0.1.67 > 192.168.0.8.68: UDP, length 300
                      14:09:54.302708 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:09:54.303257 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:11:05.209064 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:11:05.209391 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:12:21.332862 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:12:21.333416 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:13:32.248554 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:13:32.249104 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:14:48.387968 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:14:48.388412 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:15:59.272833 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:15:59.273411 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:17:15.401216 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:17:15.401781 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:18:26.301165 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:18:26.301703 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:19:42.426802 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:19:42.427330 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:20:53.327964 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:20:53.328473 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:22:09.473405 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:22:09.473946 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:23:20.366166 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:23:20.366728 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:24:36.508575 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:24:36.509133 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:25:47.386482 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:25:47.387036 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:27:03.531066 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:27:03.531592 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:28:14.419774 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:28:14.420351 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:29:16.377150 IP 192.168.0.2.68 > 192.168.0.1.67: UDP, length 300
                      14:29:16.377781 IP 192.168.0.1.67 > 192.168.0.2.68: UDP, length 300
                      14:29:30.562154 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:29:30.562678 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:29:32.499295 IP 192.168.0.4.68 > 192.168.0.1.67: UDP, length 300
                      14:29:32.499898 IP 192.168.0.1.67 > 192.168.0.4.68: UDP, length 300
                      14:30:41.447879 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:30:41.448453 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:31:57.590702 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:31:57.591241 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:33:08.477832 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:33:08.478533 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:34:24.613182 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:34:24.613725 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:35:35.525673 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:35:35.526238 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:36:51.639056 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:36:51.639633 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:38:02.537047 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:38:02.537576 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:38:34.151189 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 325
                      14:38:34.151777 IP 192.168.0.1.67 > 192.168.0.21.68: UDP, length 300
                      14:38:37.079244 IP 192.168.0.21.68 > 255.255.255.255.67: UDP, length 300
                      14:38:37.080779 IP 192.168.0.1.67 > 192.168.0.21.68: UDP, length 300
                      14:39:18.698503 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:39:18.699078 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:40:29.581411 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:40:29.582059 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:41:45.723118 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:41:45.723655 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:42:56.595484 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:42:56.596022 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:44:12.746261 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:44:12.746851 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:45:23.643417 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:45:23.643972 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:46:39.772214 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:46:39.772737 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:47:50.671900 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:47:50.672421 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:48:12.952981 IP 192.168.0.20.68 > 192.168.0.1.67: UDP, length 309
                      14:48:12.953471 IP 192.168.0.1.67 > 192.168.0.20.68: UDP, length 300
                      14:48:28.972380 IP 192.168.0.5.68 > 192.168.0.1.67: UDP, length 548
                      14:48:28.973148 IP 192.168.0.1.67 > 192.168.0.5.68: UDP, length 300
                      14:49:06.795967 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:49:06.796500 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:50:07.706768 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:50:07.707216 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:51:16.500936 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:51:16.501517 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:52:32.671283 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:52:32.671826 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:53:21.089192 IP 192.168.0.3.68 > 192.168.0.1.67: UDP, length 304
                      14:53:21.089792 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:53:43.541127 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:53:43.541603 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:54:31.692123 IP 192.168.0.9.68 > 192.168.0.1.67: UDP, length 300
                      14:54:31.692705 IP 192.168.0.1.67 > 192.168.0.9.68: UDP, length 300
                      14:54:59.685348 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:54:59.685882 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:56:10.564310 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:56:10.564869 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:57:26.708778 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:57:26.709339 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:58:37.602477 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:58:37.603072 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      14:59:53.742837 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      14:59:53.743407 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:01:04.620733 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:01:04.621437 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:02:20.805564 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:02:20.806041 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:03:31.661704 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:03:31.662285 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:04:47.802743 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:04:47.803271 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:05:58.684574 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:05:58.685215 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:06:44.941731 IP 192.168.0.8.68 > 192.168.0.1.67: UDP, length 300
                      15:06:44.942322 IP 192.168.0.1.67 > 192.168.0.8.68: UDP, length 300
                      15:07:14.844314 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:07:14.844852 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:08:25.718146 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:08:25.718688 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:09:41.875060 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:09:41.875596 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:10:52.746631 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:10:52.747171 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:12:08.894856 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:12:08.895232 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:13:19.772248 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:13:19.772688 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:14:35.930614 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:14:35.931154 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:15:46.807908 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:15:46.808536 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:17:02.969202 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:17:02.969761 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:18:13.850221 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:18:13.850775 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:19:29.983975 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:19:29.984534 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:20:07.469617 IP 192.168.0.2.68 > 192.168.0.1.67: UDP, length 300
                      15:20:07.470145 IP 192.168.0.1.67 > 192.168.0.2.68: UDP, length 300
                      15:20:40.864215 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:20:40.864598 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:20:51.049124 IP 192.168.0.4.68 > 192.168.0.1.67: UDP, length 300
                      15:20:51.049721 IP 192.168.0.1.67 > 192.168.0.4.68: UDP, length 300
                      15:21:57.008003 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:21:57.008486 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:23:07.910058 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:23:07.910598 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:24:24.032228 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:24:24.032803 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:25:34.931783 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:25:34.932216 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:26:51.068897 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:26:51.069488 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:28:01.962519 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:28:01.963058 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:29:18.103446 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:29:18.104001 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:30:28.997750 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:30:28.998302 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:31:45.134182 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:31:45.134746 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:32:56.017355 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:32:56.017951 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:34:12.159395 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:34:12.159958 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:35:23.052828 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:35:23.053398 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:36:39.189685 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:36:39.190247 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:37:50.087672 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:37:50.088225 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:39:06.224828 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:39:06.225355 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:40:17.110800 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:40:17.111354 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:41:33.248090 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:41:33.248632 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:42:44.133854 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:42:44.134399 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      15:44:00.270609 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                      15:44:00.271170 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                      
                      

                      the odd mac is back at 10:16:45

                      192.168.0.30  	00:ab:00:00:00:00  	  	2015/06/17 10:16:45  	cltt 3  	offline  	active 
                      
                      1 Reply Last reply Reply Quote 0
                      • johnpozJ Offline
                        johnpoz LAYER 8 Global Moderator
                        last edited by

                        so did you download your capture and look at in wireshark?

                        Hmmm
                        Doesn't look like you caught anything

                        10:15:14.675016 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                        10:15:14.675594 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300
                        10:20:05.543198 IP 192.168.0.3.68 > 255.255.255.255.67: UDP, length 300
                        10:20:05.543722 IP 192.168.0.1.67 > 192.168.0.3.68: UDP, length 300

                        You have an issue with 192.168.0.3 for sure.. What is the lease time on it?  Your seeing dhcp traffic every couple of minutes on him??

                        An intelligent man is sometimes forced to be drunk to spend time with his fools
                        If you get confused: Listen to the Music Play
                        Please don't Chat/PM me for help, unless mod related
                        SG-4860 25.07 | Lab VMs 2.8, 25.07

                        1 Reply Last reply Reply Quote 0
                        • F Offline
                          firefox
                          last edited by

                          i installed wireshark

                          but do i use it
                          how do i take the Result And passes it to  wireshark

                          1 Reply Last reply Reply Quote 0
                          • johnpozJ Offline
                            johnpoz LAYER 8 Global Moderator
                            last edited by

                            the download button, then open it in wireshark.. But from what you posted I don't see any dhcp traffic at the time of the lease.

                            An intelligent man is sometimes forced to be drunk to spend time with his fools
                            If you get confused: Listen to the Music Play
                            Please don't Chat/PM me for help, unless mod related
                            SG-4860 25.07 | Lab VMs 2.8, 25.07

                            1 Reply Last reply Reply Quote 0
                            • T Offline
                              tim.mcmanus
                              last edited by

                              @firefox:

                              i installed wireshark

                              but do i use it
                              how do i take the Result And passes it to  wireshark

                              Do you have any D-Link hardware on your network?  A Google search of that MAC address shows up regularly in forums discussing exactly the issue you are experiencing.  In many cases, there is a D-Link piece of hardware on the network where 00🆎00:00:00:00 shows up.

                              Wireless access points have two NICs in them (minimum) the wired network and the wireless network.  If you do have a D-link device, see if you can determine what the MAC address of each interface is.

                              1 Reply Last reply Reply Quote 0
                              • johnpozJ Offline
                                johnpoz LAYER 8 Global Moderator
                                last edited by

                                also just to cover all the bases on the pfsense via console or ssh to it do a ifconfig –- this will show you all the macs of all the inerfacers on the pfsense box.

                                An intelligent man is sometimes forced to be drunk to spend time with his fools
                                If you get confused: Listen to the Music Play
                                Please don't Chat/PM me for help, unless mod related
                                SG-4860 25.07 | Lab VMs 2.8, 25.07

                                1 Reply Last reply Reply Quote 0
                                • F Offline
                                  firefox
                                  last edited by

                                  i do have a d link router that i use as AP
                                  but it is Connected and working for a year now
                                  And this address appeared week and a half maybe two weeks ago
                                  Also checked the mac address of this router
                                  It is different

                                  Currently the router is disconnected from the network Because of Different reason (Room renovation)

                                  fxp0: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
                                  	options=9 <rxcsum,vlan_mtu>ether 00:09:6b:d1:03:04
                                  	inet6 fe80::209:6bff:fed1:304%fxp0 prefixlen 64 scopeid 0x1 
                                  	nd6 options=3 <performnud,accept_rtadv>media: Ethernet autoselect (100baseTX <full-duplex>)
                                  	status: active
                                  ath0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 2290
                                  	ether 00:23:cd:d7:15:c4
                                  	media: IEEE 802.11 Wireless Ethernet autoselect mode 11g <hostap>status: running
                                  dc0: flags=8843 <up,broadcast,running,simplex,multicast>metric 0 mtu 1500
                                  	options=80008 <vlan_mtu,linkstate>ether 00:80:ad:73:b7:fe
                                  	inet6 fe80::280:adff:fe73:b7fe%dc0 prefixlen 64 scopeid 0x3 
                                  	nd6 options=1 <performnud>media: Ethernet autoselect (none)
                                  	status: no carrier
                                  fxp1: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
                                  	options=2008 <vlan_mtu,wol_magic>ether 00:02:b3:0b:ab:2e
                                  	inet6 fe80::202:b3ff:fe0b:ab2e%fxp1 prefixlen 64 scopeid 0x4 
                                  	nd6 options=1 <performnud>media: Ethernet autoselect (100baseTX <full-duplex>)
                                  	status: active
                                  enc0: flags=0<> metric 0 mtu 1536
                                  pfsync0: flags=0<> metric 0 mtu 1460
                                  	syncpeer: 224.0.0.240 maxupd: 128 syncok: 1
                                  lo0: flags=8049 <up,loopback,running,multicast>metric 0 mtu 16384
                                  	options=3 <rxcsum,txcsum>inet 127.0.0.1 netmask 0xff000000 
                                  	inet6 ::1 prefixlen 128 
                                  	inet6 fe80::1%lo0 prefixlen 64 scopeid 0x7 
                                  	nd6 options=3 <performnud,accept_rtadv>pflog0: flags=100 <promisc>metric 0 mtu 33192
                                  ath0_wlan0: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
                                  	ether 00:23:cd:d7:15:c4
                                  	inet6 fe80::223:cdff:fed7:15c4%ath0_wlan0 prefixlen 64 scopeid 0x9 
                                  	nd6 options=1 <performnud>media: IEEE 802.11 Wireless Ethernet autoselect mode 11g <hostap>status: running
                                  	ssid "my home wifi name" channel 7 (2442 MHz 11g) bssid 00:23:cd:d7:15:c4
                                  	regdomain NONE country IL indoor ecm authmode WPA privacy MIXED
                                  	deftxkey 2 TKIP 2:128-bit TKIP 3:128-bit txpower 30 scanvalid 60
                                  	protmode OFF burst -apbridge dtimperiod 1 -dfs
                                  bridge0: flags=8943 <up,broadcast,running,promisc,simplex,multicast>metric 0 mtu 1500
                                  	ether 02:11:79:20:3d:00
                                  	inet 192.168.0.1 netmask 0xffffff00 broadcast 192.168.0.255
                                  	id 00:00:00:00:00:00 priority 32768 hellotime 2 fwddelay 15
                                  	maxage 20 holdcnt 6 proto rstp maxaddr 100 timeout 1200
                                  	root id 00:00:00:00:00:00 priority 32768 ifcost 0 port 0
                                  	member: fxp1 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 4 priority 128 path cost 55
                                  	member: ath0_wlan0 flags=143 <learning,discover,autoedge,autoptp>ifmaxaddr 0 port 9 priority 128 path cost 370370
                                  pppoe1: flags=89d1 <up,pointopoint,running,noarp,promisc,simplex,multicast>metric 0 mtu 1492
                                  	inet 5.22.135.57 --> 109.226.1.4 netmask 0xffffffff 
                                  	inet6 fe80::209:6bff:fed1:304%pppoe1 prefixlen 64 scopeid 0xa 
                                  	nd6 options=3 <performnud,accept_rtadv></performnud,accept_rtadv></up,pointopoint,running,noarp,promisc,simplex,multicast></learning,discover,autoedge,autoptp></learning,discover,autoedge,autoptp></up,broadcast,running,promisc,simplex,multicast></hostap></performnud></up,broadcast,running,promisc,simplex,multicast></promisc></performnud,accept_rtadv></rxcsum,txcsum></up,loopback,running,multicast></full-duplex></performnud></vlan_mtu,wol_magic></up,broadcast,running,promisc,simplex,multicast></performnud></vlan_mtu,linkstate></up,broadcast,running,simplex,multicast></hostap></up,broadcast,running,simplex,multicast></full-duplex></performnud,accept_rtadv></rxcsum,vlan_mtu></up,broadcast,running,promisc,simplex,multicast> 
                                  
                                  1 Reply Last reply Reply Quote 0
                                  • johnpozJ Offline
                                    johnpoz LAYER 8 Global Moderator
                                    last edited by

                                    So you have a bridge with your wifi and lan (fxp1)  – redo the sniff test but listen on the wifi interface this time.

                                    So if the device was connected to one of you AP on your lan network you should of seen it in the capture.  But guess it could of come in with your wlan on pfsense that you have bridged to your lan and not seen it in the capture..

                                    What devices are connected to your pfsense wifi interface?

                                    An intelligent man is sometimes forced to be drunk to spend time with his fools
                                    If you get confused: Listen to the Music Play
                                    Please don't Chat/PM me for help, unless mod related
                                    SG-4860 25.07 | Lab VMs 2.8, 25.07

                                    1 Reply Last reply Reply Quote 0
                                    • 2 Offline
                                      2chemlud Banned
                                      last edited by

                                      Totally OT:

                                      Some months ago I had a really bad dream that all the WLAN routers and devices could be connected to one big, global network by a bad, bad 3-letter agency in totalitarian country somewhere in the world…

                                      Just a dream :-)

                                      1 Reply Last reply Reply Quote 0
                                      • F Offline
                                        firefox
                                        last edited by

                                        – redo the sniff test but listen on the wifi interface this time.

                                        what is – redo

                                        What devices are connected to your pfsense wifi interface?

                                        the wifi card used as AP

                                        the PFsense is in one room when i connect a device to the wifi
                                        i can go Anywhere and the device just jump from one AP to the other

                                        room 1 wifi card
                                        room 2 edimax router config as AP (no dhcp and static ip)
                                        room 3 dlink router config as AP (no dhcp and static ip)
                                        room 4 Cisco AP

                                        1 Reply Last reply Reply Quote 0
                                        • 2 Offline
                                          2chemlud Banned
                                          last edited by

                                          redo = re-do = do it again :O

                                          1 Reply Last reply Reply Quote 0
                                          • P Offline
                                            phil.davis
                                            last edited by

                                            http://forums.wi-fiplanet.com/printthread.php?t=6928&pp=40

                                            And yesterday the phantom Mac address was back.
                                            This time I noticed it came in about 10 seconds after I booted this machine.
                                            While messing with some settings I noticed in the Connections window a (Internet Gateway ) Icon would pop in then disappear every 10 too 20 seconds.
                                            This machine is running XP home . I also read something in the log about the DHCP allocator not setting an IP because a router was detected .( ERROR)
                                            I found the setting in add remove windows componets / Networking services / Click Details / Internet Gateway device Discovery console yada yada yada . It was installed.
                                            Un checking that took care of the second connection poping up in the connections window.
                                            So far the phantom Mac hasen't been back since that change was made.

                                            Maybe there is a clue there. Although I can't find any real documentation of how Internet Gateway device Discovery works under the hood in relation to this special MAC address.
                                            I noticed this back in 2013 and never found out the real cause: https://forum.pfsense.org/index.php?topic=59993.0
                                            Also there is a fix to the Status DHCP Leases display - it should display "Never" in the expiration column for those leases. It was fixed by https://github.com/pfsense/pfsense/commit/6eb5191b7c92186e242481699f51cc8b4e55646c and that fix should be in 2.2.2-RELEASE. But that pfSense display fix won't make any difference to the question here.

                                            As the Greek philosopher Isosceles used to say, "There are 3 sides to every triangle."
                                            If I helped you, then help someone else - buy someone a gift from the INF catalog http://secure.inf.org/gifts/usd/

                                            1 Reply Last reply Reply Quote 0
                                            • First post
                                              Last post
                                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.