Netgate Discussion Forum
    • Categories
    • Recent
    • Tags
    • Popular
    • Users
    • Search
    • Register
    • Login

    DHCP from wrong interface

    Scheduled Pinned Locked Moved DHCP and DNS
    10 Posts 5 Posters 2.0k Views
    Loading More Posts
    • Oldest to Newest
    • Newest to Oldest
    • Most Votes
    Reply
    • Reply as topic
    Log in to reply
    This topic has been deleted. Only users with topic management privileges can see it.
    • K
      kitdavis
      last edited by

      I have a setup with 2 lan type interfaces, LAN and OPT1. Each is connected to a separate bank of switches. The LAN side DHCP server is setup to provide addreses in the 192.168.187.0/24 subnet and the OPT1 interface has a DHCP server that distributes addresses in the 192.168.189.0/24 subnet. There is no physical interconnection between the networks (one is for PCs and the other is for IP phones). This has worked without issue for 6 or more months, however, recently a couple of users have had problems and I found this was because they had an ip address in the 189 subnet rather than the 187 subnet. I thought that someone had made some type of interconnect but can not find anything. I see the following in the log:
      Aug 20 15:38:19 dhcpd DHCPDISCOVER from 3c:97:0e:bb:27:8e via igb1
      Aug 20 15:38:19 dhcpd DHCPDISCOVER from 3c:97:0e:bb:27:8e via igb3
      Aug 20 15:38:20 dhcpd DHCPOFFER on 192.168.187.12 to 3c:97:0e:bb:27:8e (xxxx) via igb1
      Aug 20 15:38:20 dhcpd DHCPOFFER on 192.168.189.101 to 3c:97:0e:bb:27:8e (xxxx) via igb3
      Aug 20 15:38:20 dhcpd DHCPREQUEST for 192.168.187.12 (192.168.187.254) from 3c:97:0e:bb:27:8e (xxxxx) via igb3: wrong network.
      Aug 20 15:38:20 dhcpd DHCPNAK on 192.168.187.12 to 3c:97:0e:bb:27:8e via igb3
      Aug 20 15:38:20 dhcpd DHCPREQUEST for 192.168.187.12 (192.168.187.254) from 3c:97:0e:bb:27:8e (xxxxx) via igb1
      Aug 20 15:38:20 dhcpd DHCPACK on 192.168.187.12 to 3c:97:0e:bb:27:8e (xxxxx) via igb1
      Aug 20 15:38:20 dhcpd DHCPDISCOVER from 3c:97:0e:bb:27:8e (xxxxx) via igb3
      Aug 20 15:38:20 dhcpd DHCPOFFER on 192.168.189.101 to 3c:97:0e:bb:27:8e (xxxx) via igb3
      reply with unaltered, existing lease for 192.168.189.24

      It looks as if the DHCP servers are both offering addresses on the LAN side of the network. Both DHCP servers are setup with the defaults and with a /24 subnet. Any thoughts on what can be causing this behavior?

      1 Reply Last reply Reply Quote 0
      • johnpozJ
        johnpoz LAYER 8 Global Moderator
        last edited by

        @kitdavis said in DHCP from wrong interface:

        Aug 20 15:38:19 dhcpd DHCPDISCOVER from 3c:97:0e:bb:27:8e via igb1
        Aug 20 15:38:19 dhcpd DHCPDISCOVER from 3c:97:0e:bb:27:8e via igb3

        Clearly that is WRONG... you are seeing discover on both interfaces.. This points to a cross connections between your physical networks.

        An intelligent man is sometimes forced to be drunk to spend time with his fools
        If you get confused: Listen to the Music Play
        Please don't Chat/PM me for help, unless mod related
        SG-4860 24.11 | Lab VMs 2.8, 24.11

        1 Reply Last reply Reply Quote 0
        • K
          kitdavis
          last edited by

          That is what I thought and was afraid of... I went through all of the switches and connections in the rack and there is no cross connect. I wanted to verify that there was no problem in pfsense that would create this behavior. Obviously some user somewhere in the building has come up with an "innovative" approach to plugging in a device. This means I now need to go office to office looking for the culprit...

          NogBadTheBadN 1 Reply Last reply Reply Quote 0
          • M
            msf2000
            last edited by

            Definitely sounds like a cross-connect between switches, probably at a user's desk location.

            Also, I read that one of those networks/interfaces was exclusively for IP-based phones. If you're in luck, those phones probably have the same starting MAC address (e.g., first 6 characters) if they are from the same manufacturer. If so, you can try using the MAC address restrictions in the DHCP server settings to only issue IPs to phones. IIRC, the setting is called "MAC address control" under /services_dhcp.php.

            1 Reply Last reply Reply Quote 0
            • NogBadTheBadN
              NogBadTheBad @kitdavis
              last edited by NogBadTheBad

              @kitdavis said in DHCP from wrong interface:

              That is what I thought and was afraid of... I went through all of the switches and connections in the rack and there is no cross connect. I wanted to verify that there was no problem in pfsense that would create this behavior. Obviously some user somewhere in the building has come up with an "innovative" approach to plugging in a device. This means I now need to go office to office looking for the culprit...

              What switches & VOIP phones do you use ?

              Andy

              1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

              1 Reply Last reply Reply Quote 0
              • johnpozJ
                johnpoz LAYER 8 Global Moderator
                last edited by

                what switches do you have? Can you not track down which interface a mac is connected to? If the switches are smart/managed you should be able to use say the above example mac and track down where your cross connection is happening.

                An intelligent man is sometimes forced to be drunk to spend time with his fools
                If you get confused: Listen to the Music Play
                Please don't Chat/PM me for help, unless mod related
                SG-4860 24.11 | Lab VMs 2.8, 24.11

                1 Reply Last reply Reply Quote 0
                • NogBadTheBadN
                  NogBadTheBad
                  last edited by NogBadTheBad

                  @kitdavis said in DHCP from wrong interface:

                  3c:97:0e

                  3c:97:0e = Wistron InfoComm(Kunshan)Co.,Ltd.

                  https://www.wireshark.org/tools/oui-lookup.html

                  Not that it helps looks like Wistron are an OEM.

                  Andy

                  1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                  1 Reply Last reply Reply Quote 0
                  • NogBadTheBadN
                    NogBadTheBad
                    last edited by NogBadTheBad

                    @kitdavis said in DHCP from wrong interface:

                    3c:97:0e:bb:27:8e

                    I wonder if you'll see anything in the DHCP packet if you do a packet capture and view it in wireshark.

                    tcpdump -i igb1 ether host 3c:97:0e:bb:27:8e and port 67 -w capture.pcap

                    tcpdump -i igb1 ether host 3c:97:0e:bb:27:8e and port 67 -vvv

                    Andy

                    1 x Netgate SG-4860 - 3 x Linksys LGS308P - 1 x Aruba InstantOn AP22

                    1 Reply Last reply Reply Quote 0
                    • DerelictD
                      Derelict LAYER 8 Netgate
                      last edited by

                      Yeah in that case if you have decent switches you can do something like:

                      show mac-address VLAN XXX or show mac-address | inc 3c:97:0e and see what ports the switch thinks that MAC address is on and maybe find it. Might need to run it on multiple switches.

                      Or something of that nature.

                      Chattanooga, Tennessee, USA
                      A comprehensive network diagram is worth 10,000 words and 15 conference calls.
                      DO NOT set a source address/port in a port forward or firewall rule unless you KNOW you need it!
                      Do Not Chat For Help! NO_WAN_EGRESS(TM)

                      1 Reply Last reply Reply Quote 0
                      • K
                        kitdavis
                        last edited by

                        Thanks for all of the suggestions - I looked at the mac addresses attached to all of the switches yesterday and didn't find the culprit. It is intermittent -- it happened to two users late last week and then again yesterday. (and I am pretty sure it happened twice before that - but wasn't recognized for the problem it is) I suspect it is some portable device that someone brings to the office and plugs in for a period of time. As long as nothing requests a new address things keep working. Hopefully the next time it happens I'll be in the area and can do some packet captures for some additional information.

                        1 Reply Last reply Reply Quote 0
                        • First post
                          Last post
                        Copyright 2025 Rubicon Communications LLC (Netgate). All rights reserved.