Weird log entry

Atlanta-Mike · Sep 9, 2012, 1:13 PM

Any idea what this log entry means:

dhcpd: parse_option_buffer: option www-server (121) larger than buffer.

SeventhSon · Sep 10, 2012, 9:03 PM

some malformed, weird dhcp packets coming in with custom options set?
Is there a dhcp lease just before or after, so you can see what device is sending the dhcp packet?

Atlanta-Mike · Sep 10, 2012, 10:24 PM

There are these entries before the log entry mentioned:

Sep 10 10:42:39 dhclient[60048]: bound to 9x.8x.1xx.2xx – renewal in 14400 seconds.
Sep 10 10:42:39 dhclient[60048]: DHCPACK from 6x.1xx.3x.2xx
Sep 10 10:42:39 dhclient[60048]: SENDING DIRECT
Sep 10 10:42:39 dhclient[60048]: DHCPREQUEST on em0 to 6x.1xx.3x.2xx port 67

I replaced some of the numbers with x's. The 9x.8x.1xx.2xx is my WAN IP address. I think the second address is my ISP. I am using 8.8.8.8 and 8.8.4.4 for DNS.

I also see something like this every once in a while (IP is not always the same): kernel: arplookup 100.183.158.141 failed: host is not on local network

Looking right before the first problem entry after a re-boot is the following entries:

root: IP-Blocklist was found not running
root: Countryblock was found not running

I think this is the process where it makes sure those packages are running.

SeventhSon · Sep 10, 2012, 10:42 PM

Your ISP is handing some options to you in the DHCP lease it seems, nothing to be worried about, usually stuff for their own equipment.