Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    Starry Internet Station Replacement with pfSense?

    Scheduled Pinned Locked Moved General pfSense Questions
    16 Posts 3 Posters 1.5k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • stephenw10S
      stephenw10 Netgate Administrator
      last edited by

      A wifi router like that will have several MAC addresses and it's not uncommon to find the one listed on the label is not the WAN. Just to be clear are you sure that was the WAN MAC and not the wifi MAC for example? I have seen others hit that issue before.

      Is the wifi router sending the 'name' value as the 'hostname'?

      Ultimately you could put something between their modem and router and capture the DHCP exchange to see exactly what is needed.

      Steve

      1 Reply Last reply Reply Quote 0
      • L
        lastb0isct
        last edited by

        I was thinking I could do that and just do a wireshark of some kind. I'm not certain that it is the WAN mac address, but the guy on the other thread said that worked so I assumed those were the correct values.

        I'll have to try and do that later today. Curious what would be good to put between it? I have a couple different systems I could do that with...

        1 Reply Last reply Reply Quote 0
        • stephenw10S
          stephenw10 Netgate Administrator
          last edited by

          A switch with mirror port configured or pfSense with two ports bridged is what I would do there.

          L 1 Reply Last reply Reply Quote 0
          • L
            lastb0isct @stephenw10
            last edited by

            @stephenw10 Might be a bit out of my realm! I don't have an extra switch and my pfsense has extra ports but not sure how to use wireshark on freebsd...or how to bridge those ports.

            1 Reply Last reply Reply Quote 0
            • stephenw10S
              stephenw10 Netgate Administrator
              last edited by

              Bridging the ports is pretty easy. Just enble the two extra ports as interfaces but leave them as IPv4 type 'none'. Now go to Interfaces > Assignments > Bridges and create a new bridge with those ports in it. Now add allow all firewall rules on both those interfaces. Don't use, for example, OPT1net in the rules as that is invalid for an interface without an IP. True pass any, any , any.

              Now connect the modem to one and the wifi router to the other. Start a packet capture on the modem side port filter for port 67, set it to promiscuous mode and set the packets to, say, 1000. Reboot the wifi router and wait for it to pull an IP.

              Steve

              L 1 Reply Last reply Reply Quote 1
              • L
                lastb0isct @stephenw10
                last edited by

                @stephenw10 Thank you for the quick rundown. Might try this later today as i have 2x realtek onboard connections that aren't in use at all (because realtek kinda sucks).

                1 Reply Last reply Reply Quote 0
                • L
                  lastb0isct
                  last edited by lastb0isct

                  @stephenw10 said in Starry Internet Station Replacement with pfSense?:

                  Bridging the ports is pretty easy. Just enble the two extra ports as interfaces but leave them as IPv4 type 'none'. Now go to Interfaces > Assignments > Bridges and create a new bridge with those ports in it. Now add allow all firewall rules on both those interfaces. Don't use, for example, OPT1net in the rules as that is invalid for an interface without an IP. True pass any, any , any.

                  Now connect the modem to one and the wifi router to the other. Start a packet capture on the modem side port filter for port 67, set it to promiscuous mode and set the packets to, say, 1000. Reboot the wifi router and wait for it to pull an IP.

                  Steve

                  I was finally able to try this today! I know it has been months...

                  So I did the packet captures and was able to find the mac and the hostname. I changed it to that on my WAN address and at first it successfully pulled, but now it is not. I then passed the traffic through the bridge when connecting to my pfsense to capture what was happening so I have both of them. Maybe you can look and see what I'm missing? Is it possible to do BOOTP/DHCP on pfsense, rather than just DHCP?

                  Here is the successful licensing of the ISP provided router:

                  09:34:09.934036 IP (tos 0x0, ttl 64, id 20794, offset 0, flags [none], proto UDP (17), length 379)
    0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 8c:a2:fd:01:0f:fc, length 351, xid 0xd2c635fc, Flags [none]
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: Request
	    Client-ID Option 61, length 19: hardware-type 255, fd:01:0f:fc:00:01:00:01:24:b8:ba:a4:8c:a2:fd:01:0f:fc
	    Requested-IP Option 50, length 4: 142.79.218.242
	    Server-ID Option 54, length 4: 8.3.88.1
	    MSZ Option 57, length 2: 1472
	    Vendor-Class Option 60, length 41: "dhcpcd-7.0.8:Linux-3.10.70:armv7l:Marvell"
	    Hostname Option 12, length 6: "starry"
	    T145 Option 145, length 1: 1
	    Parameter-Request Option 55, length 14: 
	      Subnet-Mask, Classless-Static-Route, Static-Route, Default-Gateway
	      Domain-Name-Server, Hostname, Domain-Name, BR
	      NTP, Lease-Time, Server-ID, RN
	      RB, Option 119
09:34:10.297142 IP (tos 0xc0, ttl 30, id 61956, offset 0, flags [none], proto UDP (17), length 280)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 252, xid 0x12d107c5, Flags [Broadcast]
	  Client-Ethernet-Address 98:0d:67:f2:4e:7b
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Server-ID Option 54, length 4: 8.3.88.1
09:34:11.897127 IP (tos 0xc0, ttl 30, id 62724, offset 0, flags [none], proto UDP (17), length 280)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 252, xid 0x92bd7eb, Flags [Broadcast]
	  Client-Ethernet-Address 98:0d:67:f4:b2:bb
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Server-ID Option 54, length 4: 8.3.88.1
09:34:11.897155 IP (tos 0xc0, ttl 30, id 62980, offset 0, flags [none], proto UDP (17), length 280)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 252, xid 0xcb43862, Flags [Broadcast]
	  Client-Ethernet-Address 08:26:97:60:84:b3
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Server-ID Option 54, length 4: 8.3.88.1
09:34:12.973759 IP (tos 0xc0, ttl 30, id 64260, offset 0, flags [none], proto UDP (17), length 280)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 252, xid 0x2d6a0a60, Flags [Broadcast]
	  Client-Ethernet-Address 98:0d:67:f4:78:1b
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Server-ID Option 54, length 4: 8.3.88.1
09:34:13.097117 IP (tos 0xc0, ttl 30, id 65028, offset 0, flags [none], proto UDP (17), length 280)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 252, xid 0x8295c8e, Flags [Broadcast]
	  Client-Ethernet-Address 98:0d:67:f4:77:7b
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Server-ID Option 54, length 4: 8.3.88.1
09:34:13.098803 IP (tos 0xc0, ttl 30, id 65284, offset 0, flags [none], proto UDP (17), length 280)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 252, xid 0x4f635a16, Flags [Broadcast]
	  Client-Ethernet-Address 98:0d:67:8f:65:83
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Server-ID Option 54, length 4: 8.3.88.1
09:34:13.638441 IP (tos 0x0, ttl 64, id 11746, offset 0, flags [none], proto UDP (17), length 379)
    0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 8c:a2:fd:01:0f:fc, length 351, xid 0xd2c635fc, secs 3, Flags [none]
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: Request
	    Client-ID Option 61, length 19: hardware-type 255, fd:01:0f:fc:00:01:00:01:24:b8:ba:a4:8c:a2:fd:01:0f:fc
	    Requested-IP Option 50, length 4: 142.79.218.242
	    Server-ID Option 54, length 4: 8.3.88.1
	    MSZ Option 57, length 2: 1472
	    Vendor-Class Option 60, length 41: "dhcpcd-7.0.8:Linux-3.10.70:armv7l:Marvell"
	    Hostname Option 12, length 6: "starry"
	    T145 Option 145, length 1: 1
	    Parameter-Request Option 55, length 14: 
	      Subnet-Mask, Classless-Static-Route, Static-Route, Default-Gateway
	      Domain-Name-Server, Hostname, Domain-Name, BR
	      NTP, Lease-Time, Server-ID, RN
	      RB, Option 119

                  Here is the unsuccessful dhcp request from pfsense (It is almost like the spoofed MAC Addr on the WAN int on pfsense isn't being used initially[do i need to reboot after setting the spoofed mac addr?]):

                  09:46:46.637310 IP (tos 0xc0, ttl 30, id 50442, offset 0, flags [none], proto UDP (17), length 280)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 252, xid 0x2741ee24, Flags [Broadcast]
	  Client-Ethernet-Address 08:26:97:70:0e:e3
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Server-ID Option 54, length 4: 8.3.88.1
09:46:49.997319 IP (tos 0xc0, ttl 30, id 50954, offset 0, flags [none], proto UDP (17), length 280)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 252, xid 0x51a8f57b, Flags [Broadcast]
	  Client-Ethernet-Address 08:26:97:70:0e:e3
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Server-ID Option 54, length 4: 8.3.88.1
09:46:51.343343 IP (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 8c:a2:fd:01:0f:fc, length 300, xid 0xae3ce318, Flags [none]
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: Discover
	    Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79
	    Hostname Option 12, length 6: "starry"
	    Parameter-Request Option 55, length 10: 
	      Subnet-Mask, BR, Time-Zone, Classless-Static-Route
	      Default-Gateway, Domain-Name, Domain-Name-Server, Hostname
	      Option 119, MTU
09:46:51.469325 IP (tos 0xc0, ttl 30, id 51210, offset 0, flags [none], proto UDP (17), length 326)
    8.3.88.1.67 > 142.79.218.242.68: BOOTP/DHCP, Reply, length 298, xid 0xae3ce318, Flags [none]
	  Your-IP 142.79.218.242
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: Offer
	    Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79
	    RN Option 58, length 4: 259200
	    RB Option 59, length 4: 453600
	    Lease-Time Option 51, length 4: 518400
	    Server-ID Option 54, length 4: 8.3.88.1
	    Subnet-Mask Option 1, length 4: 255.255.254.0
	    Domain-Name-Server Option 6, length 8: 8.8.8.8,1.1.1.1
	    Default-Gateway Option 3, length 4: 142.79.218.1
09:46:53.389337 IP (tos 0xc0, ttl 30, id 51722, offset 0, flags [none], proto UDP (17), length 280)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 252, xid 0x5b132fe4, Flags [Broadcast]
	  Client-Ethernet-Address 08:26:97:70:0e:e3
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Server-ID Option 54, length 4: 8.3.88.1
09:46:53.395397 IP (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 8c:a2:fd:01:0f:fc, length 300, xid 0xae3ce318, Flags [none]
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: Request
	    Server-ID Option 54, length 4: 8.3.88.1
	    Requested-IP Option 50, length 4: 142.79.218.242
	    Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79
	    Hostname Option 12, length 6: "starry"
	    Parameter-Request Option 55, length 10: 
	      Subnet-Mask, BR, Time-Zone, Classless-Static-Route
	      Default-Gateway, Domain-Name, Domain-Name-Server, Hostname
	      Option 119, MTU
09:46:53.421320 IP (tos 0xc0, ttl 30, id 51978, offset 0, flags [none], proto UDP (17), length 286)
    8.3.88.1.67 > 142.79.218.242.68: BOOTP/DHCP, Reply, length 258, xid 0xae3ce318, Flags [none]
	  Your-IP 142.79.218.242
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79
	    Server-ID Option 54, length 4: 8.3.88.1
09:46:55.768119 IP (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 8c:a2:fd:01:0f:fc, length 300, xid 0xae3ce318, Flags [none]
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: Request
	    Server-ID Option 54, length 4: 8.3.88.1
	    Requested-IP Option 50, length 4: 142.79.218.242
	    Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79
	    Hostname Option 12, length 6: "starry"
	    Parameter-Request Option 55, length 10: 
	      Subnet-Mask, BR, Time-Zone, Classless-Static-Route
	      Default-Gateway, Domain-Name, Domain-Name-Server, Hostname
	      Option 119, MTU
09:46:55.789338 IP (tos 0xc0, ttl 30, id 52234, offset 0, flags [none], proto UDP (17), length 286)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 258, xid 0xae3ce318, Flags [none]
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79
	    Server-ID Option 54, length 4: 8.3.88.1
09:46:56.793305 IP (tos 0xc0, ttl 30, id 52746, offset 0, flags [none], proto UDP (17), length 280)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 252, xid 0x21ed66d8, Flags [Broadcast]
	  Client-Ethernet-Address 08:26:97:70:0e:e3
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Server-ID Option 54, length 4: 8.3.88.1
09:46:57.855309 IP (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 8c:a2:fd:01:0f:fc, length 300, xid 0xae3ce318, Flags [none]
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: Request
	    Server-ID Option 54, length 4: 8.3.88.1
	    Requested-IP Option 50, length 4: 142.79.218.242
	    Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79
	    Hostname Option 12, length 6: "starry"
	    Parameter-Request Option 55, length 10: 
	      Subnet-Mask, BR, Time-Zone, Classless-Static-Route
	      Default-Gateway, Domain-Name, Domain-Name-Server, Hostname
	      Option 119, MTU
09:46:57.881317 IP (tos 0xc0, ttl 30, id 53002, offset 0, flags [none], proto UDP (17), length 286)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 258, xid 0xae3ce318, Flags [none]
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79
	    Server-ID Option 54, length 4: 8.3.88.1
09:47:00.101331 IP (tos 0xc0, ttl 30, id 53514, offset 0, flags [none], proto UDP (17), length 280)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 252, xid 0x39101676, Flags [Broadcast]
	  Client-Ethernet-Address 08:26:97:70:0e:e3
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Server-ID Option 54, length 4: 8.3.88.1
09:47:02.110092 IP (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 8c:a2:fd:01:0f:fc, length 300, xid 0xae3ce318, Flags [none]
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: Request
	    Server-ID Option 54, length 4: 8.3.88.1
	    Requested-IP Option 50, length 4: 142.79.218.242
	    Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79
	    Hostname Option 12, length 6: "starry"
	    Parameter-Request Option 55, length 10: 
	      Subnet-Mask, BR, Time-Zone, Classless-Static-Route
	      Default-Gateway, Domain-Name, Domain-Name-Server, Hostname
	      Option 119, MTU
09:47:02.129324 IP (tos 0xc0, ttl 30, id 53770, offset 0, flags [none], proto UDP (17), length 286)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 258, xid 0xae3ce318, Flags [none]
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79
	    Server-ID Option 54, length 4: 8.3.88.1
09:47:03.345322 IP (tos 0xc0, ttl 30, id 54282, offset 0, flags [none], proto UDP (17), length 280)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 252, xid 0x6e4632d5, Flags [Broadcast]
	  Client-Ethernet-Address 08:26:97:70:0e:e3
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Server-ID Option 54, length 4: 8.3.88.1
09:47:06.885338 IP (tos 0xc0, ttl 30, id 55050, offset 0, flags [none], proto UDP (17), length 280)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 252, xid 0x4bd7f06b, Flags [Broadcast]
	  Client-Ethernet-Address 08:26:97:70:0e:e3
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Server-ID Option 54, length 4: 8.3.88.1
09:47:09.010319 IP (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 8c:a2:fd:01:0f:fc, length 300, xid 0xbcf837fb, Flags [none]
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: Discover
	    Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79
	    Hostname Option 12, length 6: "starry"
	    Parameter-Request Option 55, length 10: 
	      Subnet-Mask, BR, Time-Zone, Classless-Static-Route
	      Default-Gateway, Domain-Name, Domain-Name-Server, Hostname
	      Option 119, MTU
09:47:09.085324 IP (tos 0xc0, ttl 30, id 55306, offset 0, flags [none], proto UDP (17), length 326)
    8.3.88.1.67 > 142.79.218.242.68: BOOTP/DHCP, Reply, length 298, xid 0xbcf837fb, Flags [none]
	  Your-IP 142.79.218.242
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: Offer
	    Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79
	    RN Option 58, length 4: 259200
	    RB Option 59, length 4: 453600
	    Lease-Time Option 51, length 4: 518400
	    Server-ID Option 54, length 4: 8.3.88.1
	    Subnet-Mask Option 1, length 4: 255.255.254.0
	    Domain-Name-Server Option 6, length 8: 8.8.8.8,1.1.1.1
	    Default-Gateway Option 3, length 4: 142.79.218.1
09:47:12.030854 IP (tos 0x10, ttl 128, id 0, offset 0, flags [none], proto UDP (17), length 328)
    0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 8c:a2:fd:01:0f:fc, length 300, xid 0xbcf837fb, Flags [none]
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: Request
	    Server-ID Option 54, length 4: 8.3.88.1
	    Requested-IP Option 50, length 4: 142.79.218.242
	    Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79
	    Hostname Option 12, length 6: "starry"
	    Parameter-Request Option 55, length 10: 
	      Subnet-Mask, BR, Time-Zone, Classless-Static-Route
	      Default-Gateway, Domain-Name, Domain-Name-Server, Hostname
	      Option 119, MTU
09:47:12.053950 IP (tos 0xc0, ttl 30, id 56074, offset 0, flags [none], proto UDP (17), length 286)
    8.3.88.1.67 > 142.79.218.242.68: BOOTP/DHCP, Reply, length 258, xid 0xbcf837fb, Flags [none]
	  Your-IP 142.79.218.242
	  Client-Ethernet-Address 8c:a2:fd:01:0f:fc
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79
	    Server-ID Option 54, length 4: 8.3.88.1
09:47:12.549334 IP (tos 0xc0, ttl 30, id 56586, offset 0, flags [none], proto UDP (17), length 280)
    8.3.88.1.67 > 255.255.255.255.68: BOOTP/DHCP, Reply, length 252, xid 0xff59ef, Flags [Broadcast]
	  Client-Ethernet-Address 08:26:97:70:0e:e3
	  Vendor-rfc1048 Extensions
	    Magic Cookie 0x63825363
	    DHCP-Message Option 53, length 1: NACK
	    Server-ID Option 54, length 4: 8.3.88.1

                  I also notice that the requests inbetween the successful are being sent from Client-Ethernet-Address 98:0d:67:8f:65:83, but on the pfsense test it comes back with just the spoofed MAC Address.
                  Also the Client-ID Option is different on the pfsense:

                  Client-ID Option 61, length 6: hardware-type 115, 74:61:72:72:79

                  Compared to this on the provided hardware:

                  Client-ID Option 61, length 19: hardware-type 255, fd:01:0f:fc:00:01:00:01:24:b8:ba:a4:8c:a2:fd:01:0f:fc
                  1 Reply Last reply Reply Quote 0
                  • stephenw10S
                    stephenw10 Netgate Administrator
                    last edited by

                    The actual discovery packets do appear to be using the right MAC address.

                    But, yeah, the client option 61 is different and it's not sending option 60 at all. You may need to add those as options.
                    The hostname looks to be sent correctly though.

                    Neither of those appears to be the full DHCP (Discover, Offer, Request, Acknowledge) sequence though. The pfSense attempt is actually more complete. What did you filter the pcap by? Where was is capturing?

                    Steve

                    L 1 Reply Last reply Reply Quote 0
                    • L
                      lastb0isct @stephenw10
                      last edited by lastb0isct

                      @stephenw10 How do I add those options? From what I could tell that is not possible in pfsense...is it?

                      I just filtered by port 67 as you said and allowed all else and made sure to make it promiscuous. I thought that was all that was needed on the ISP side of things. I can do it again if required and pull the entire log if that makes a difference. Maybe I need to up the verbosity on the logging? I had it only set to Medium.

                      It was capturing on the modem side as you said as well.

                      1 Reply Last reply Reply Quote 0
                      • stephenw10S
                        stephenw10 Netgate Administrator
                        last edited by

                        You can add custom dhcp client options in pfSense. Just check the 'advanced configuration' box in the dhcp client setup and you get more fields. You can add it in the 'send options' field.

                        As an example for connecting to Sky in the UK you might use there:

                        dhcp-client-identifier "1234567890ab@skydsl|1234567890abcdef",dhcp-class-identifier "7.16a4N_UNI|PCBAFAST2504Nv1.0"

                        Which are options 61 and 60 respectively. However I'm unsure how you would enter the data you have for option 61. Try it and see how the pcap changes.

                        Steve

                        L 1 Reply Last reply Reply Quote 1
                        • L
                          lastb0isct @stephenw10
                          last edited by

                          @stephenw10 Thanks for all the help...I'll give it a shot!

                          W 1 Reply Last reply Reply Quote 0
                          • W
                            willtrking @lastb0isct
                            last edited by

                            @lastb0isct Did you ever manage to figure this out? Running into the same situation as you are.

                            1 Reply Last reply Reply Quote 0
                            • First post
                              Last post
                            Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.