DHCP sometimes doesn't assign IP address

[galt007]

Running 22.05

My setup

pfsense >> netgear GS316EP >> PC Intel NIC

netgear switch is on LAN 192.168.50.xxx

DHCP pool from 192.168.50.100 to 199
gateway @ 192.168.50.70
some static IPs below 192.168.50.100 (switches, APs)

on the PC side, when I connect to the network settings (Manjaro) the IP address of 192.168.2.1 is returned. I disconnect and reconnect and 192.168.50.128 is returned and all is good.

Similarly
pfsense >> netgear GS316EP >> netgear GS308E >> Samung TV

The TV has the same issue it gets assigned 192.168.2.110
Power the TV off (pull the plug) then on doesn't help

Both switches are brand new, upgraded firmware, default settings.

Any pointers would be appreciated

[Jarhead]

@galt007 First, what's with the crazy addressing scheme??
.70 is your gateway? Make your life easier and go with conventions.

But it would appear you have multiple dhcp servers and you need make sure you only have one active.
What is assigning 192.168.2 addresses?

[galt007]

@jarhead Open to suggestions on following conventions. What should be my gateway ip? 192.168.50.2?

I do have 4 interfaces specified in pfsense with DHCP enabled but only Pfsense is running a server

[Jarhead]

@galt007
Typically the .1 would be gateway. That's actually defaulted out of the box on pfSense. Some choose to use the last address of the subnet as gateway but arbitrarily choosing say .70 is odd.

So what is assigning the .2.x addresses. Not saying it's pfSense, most likely isn't, I would guess a switch maybe?

[galt007]

@jarhead I'm not an expert but why would a switch assign an IP address?

[Jarhead]

@galt007 Because it's dhcp server is active.
Go through all of your devices and find the server assigning the .2.x addresses, then disable it.

[galt007]

@jarhead ok I'll check in a minute I'm on my tractor right now

[galt007]

@jarhead ok both switches have DHCP mode turned off. Been that way since I assigned the switch maintenance to a static IP.

I did find this doing a packet cap when powering up the TV
TV was assigned the address 192.168.2.110

IP 192.168.50.123.48857 > 192.168.2.187.1413: tcp 0

.123 is my TIVO box - so this isnt a DHCP server.

Now If I just toggle the switch on my TV between DHCP and fixed IP the DHCP server assigns an IP address after a few attempts.

I think there is a race condition somewhere.

[Jarhead]

@galt007 That packet capture has nothing to do with dhcp.

So where is the 192.168.2.x network coming from?
Is this assigned on pfSense?

You have something else with an active dhcp server.

[Jarhead]

Wireless access point maybe?

[bingo600]

@galt007
Do you have your "Old router" or a "Wifi Box" connected ?
Those are the usual suspects, when having a rouge dhcp server.

You might not catch the offender by doing a pfSense packet trace, if the rouge unit is on the same L2 net as your devices getting a 192.168.2.x DHCP IP.
Well technically you should be able to see the broadcasts UDP 67/68.

But i would make a "Mirror port" on your switch.
On the Netgear make a "Free port" a mirror of your "TV port", connect your linux Box to the mirror port , and "Fire up Wireshark as root".

In wireshark select your Cabled interface that is connected to the mirror port, and start "sniffing".

To display filter wireshark to just show the captured DHCP packages, write : bootp - In the top line.

In the

Now just sit back and wait for some dhcp packages to be shown.

Locate the ones that hands out a DHCP Offer contaning a 192.168.2.x" IP address to the TV. And note the MAC Address of the device sending.

Now to find the offender you have 2 choices (using the mac):

1: Use your switch to track down the mac , to a specific port.

2: Use a mac address lookup tool , to try to identify the vendor it was assigned to. Wireshark might already show the vendor in the packet trace.

Lookup url's:
https://www.wireshark.org/tools/oui-lookup.html
http://www.coffer.com/mac_find/

Happy hunting

/Bingo

[galt007]

@jarhead Geeting these on a packet capture of 192.168.2.0/24

ARP, Request who-has 192.168.2.1 tell 192.168.2.110, length 46
ARP, Request who-has 192.168.2.1 tell 192.168.2.110, length 46
IP 192.168.2.110.38973 > 192.168.2.255.15600: UDP, length 35
ARP, Request who-has 192.168.2.1 tell 192.168.2.110, length 46
ARP, Request who-has 192.168.2.1 tell 192.168.2.110, length 46

the 110 address is the DHCP assinged TV address

AP's are setup in bridge mode without LAN ip addresses. WAN side of AP is DHCP but statically assigned by pfsense

[galt007]

@bingo600 Thanks for the recipe. I did find a device 192.168.2.187 connected to my wifie network. Im going to reboot that AP and see if it connects again

[bingo600]

@galt007 said in DHCP sometimes doesn't assign IP address:

ARP, Request who-has 192.168.2.1 tell 192.168.2.110, length 46

You are probably looking for a device that uses : 192.168.2.1 as the ip address.
That ARP request above , smell a lot of a Client (192.168.2.110) , arp'ing for it's default gateway (192.168.2.1). Most often the default gateway ip is the same as the DHCP server ip on SOHO devices..

/Bingo

[galt007]

@bingo600 @Jarhead Found the offending device. Actiontec ECB6000 Moca 2.0 network adapter.

Found it the old school way. TV direct to main switch, started pulling ports until the TV was assigned a proper address from PfSense.

Thanks for the help folks!

[bingo600]

@galt007
Well done.

But from the manual : https://www.actiontec.com/wp-content/uploads/2017/02/ECB6000_UserManual.pdf

It doesn't seem like that device has a DHCP server built in. So i suppose the "Rouge Server" is at "The other end" of the Coax ...

What is it used for ??

[Jarhead]

@bingo600 Had no idea what a rouge server was until the second time you posted it... rogue.

[bingo600]

@jarhead
Ah ... English isn't my native language (sorry)

[galt007]

@bingo600 that's a good question. Think it came with my tivo which might explain why my tivo was trying to talk to 192.168.2.x.

Might have been how my tivo communicated with my tivo mini.

Main tivo works fine without it as it networked properly now.