Static PC getting a DHCP lease

A Former User

Sure there isn't some other bit of software on there (Virtual PC, Virtualbox, VMware, etc) that is bridging a VM of some sort to that NIC and making an additional DHCP request?

yes i am sure.

A Former User

@stan-qaz:

I think I'm getting an understanding of the issue now…

The Windows box is set to use a static IP and is actually using it.

The pfSense system is still offering an IP lease to the Windows box and showing it as active on the pfSense status page.

Did you delete any lease info from this page if it is there? (edit the system name to match your setup)

https://pfsense.home/services_dhcp.php

Do you see a request from the Windows box to your pfSense system if you look at the DHCP logs?

https://pfsense.home/diag_logs_dhcp.php

(newest line at the top)
Feb 19 21:27:38 	dhcpd: DHCPACK on 172.16.2.51 to 00:1d:ba:5a:14:e2 via em1
Feb 19 21:27:38 	dhcpd: DHCPREQUEST for 172.16.2.51 (172.16.0.1) from 00:1d:ba:5a:14:e2 via em1
Feb 19 21:27:38 	dhcpd: DHCPOFFER on 172.16.2.51 to 00:1d:ba:5a:14:e2 via em1
Feb 19 21:27:38 	dhcpd: DHCPDISCOVER from 00:1d:ba:5a:14:e2 via em1
Feb 19 21:27:38 	dhcpd: DHCPOFFER on 172.16.2.51 to 00:1d:ba:5a:14:e2 via em1
Feb 19 21:27:38 	dhcpd: DHCPDISCOVER from 00:1d:ba:5a:14:e2 via em1
Maybe just post a section of your logs showing the DHCP conversation for your Windows box so someone better at this than I am can make a suggestion?

from the dhcp lease page i changed the lease time from default to 14400

and aside from the values i set (screen shot above) nothing else was touched on that page

logs:

Feb 19 18:10:10 dhcpd: DHCPACK on 192.168.10.209 to 00:00:00:92:93:25 (dvr) via vr0
Feb 19 18:10:10 dhcpd: DHCPREQUEST for 192.168.10.209 from 00:00:00:92:93:25 (dvr) via vr0

stan-qaz

That sure looks like the Windows box is initiating the request, not being much good at Windows I don't think I can be much help there. One Windows suggestion I'd make is to delete the network connection in Windows and recreate it from scratch and see if that helps.

I went another direction on my LAN and left all my systems set to fetch DHCP addresses. I then went to the static assignment page and set static addresses there for each system.

https://pfsense.home/services_dhcp.php

MAC address 	IP address 	Hostname 	Description 	
00:1b:21:c6:e3:48 	172.16.0.10  	t3400-1   	PCIe  	
00:1b:21:c6:d9:49 	172.16.0.11  	t3400-2   	PCIe  	
00:1b:21:7c:81:84 	172.16.0.12  	e520       	PCI  	
00:11:09:6d:b6:a0 	172.16.0.13  	gx4700   	mb
78:2b:cb:18:4e:ae 	172.16.0.16  	t310         	mb top

That gives me an IP that remains static as long as the box can access pfSense and get an IP. It also registers the system name in DNS so I can use the name to access it instead of having to recall the IP assigned.

A Former User

@stan-qaz:

That sure looks like the Windows box is initiating the request, not being much good at Windows I don't think I can be much help there. One Windows suggestion I'd make is to delete the network connection in Windows and recreate it from scratch and see if that helps.

I went another direction on my LAN and left all my systems set to fetch DHCP addresses. I then went to the static assignment page and set static addresses there for each system.

https://pfsense.home/services_dhcp.php
MAC address 	IP address 	Hostname 	Description 	
00:1b:21:c6:e3:48 	172.16.0.10  	t3400-1   	PCIe  	
00:1b:21:c6:d9:49 	172.16.0.11  	t3400-2   	PCIe  	
00:1b:21:7c:81:84 	172.16.0.12  	e520       	PCI  	
00:11:09:6d:b6:a0 	172.16.0.13  	gx4700   	mb
78:2b:cb:18:4e:ae 	172.16.0.16  	t310         	mb top  
That gives me an IP that remains static as long as the box can access pfSense and get an IP. It also registers the system name in DNS so I can use the name to access it instead of having to recall the IP assigned.

i will have to look into it a bit more when i am on site. i just did some windows updates. i will see if there is an updated driver next time i go there. everything is running as it should, which makes me not want to mess with it, but at the same time i know i should not be seeing a DHCP address, or even a request, from a machine that has a static IP address.

very odd.

thank you.

jimp

From the log the PC is definitely is sending the request, so there isn't anything pfSense can do to stop that since it's coming from the client. If you can get a capture of the request it may be possible to explain what it is looking for.

It may not just be an IP, but it might be requesting some other info from DHCP such as proxy settings, ldap url, etc.

A Former User

@jimp:

From the log the PC is definitely is sending the request, so there isn't anything pfSense can do to stop that since it's coming from the client. If you can get a capture of the request it may be possible to explain what it is looking for.

It may not just be an IP, but it might be requesting some other info from DHCP such as proxy settings, ldap url, etc.

with wireshark?

the PC is a standard workstation, nothing fancy.

edit- at least you guys helped me figure out it isn't pfsense. thank you.

jimp

Diag > Packet capture, filter on port 68

A Former User

@jimp:

Diag > Packet capture, filter on port 68

how long should i let it run for? so far captured nothing.

edit- nvm, i see the default is 100

stan-qaz

You may need to reset the interface or reboot the Windows box to get it to initiate the DHCP process that is causing the problem.

A Former User

@stan-qaz:

You may need to reset the interface or reboot the Windows box to get it to initiate the DHCP process that is causing the problem.

good idea, i just started a capture and rebooted.

20:27:19.518769 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 312

20:27:19.520606 IP 192.168.10.1.67 > 192.168.10.209.68: UDP, length 300

20:27:40.684059 IP 0.0.0.0.68 > 255.255.255.255.67: UDP, length 312

20:27:40.685875 IP 192.168.10.1.67 > 192.168.10.209.68: UDP, length 300

johnpoz

You need to download that and view it with wireshark. I would assume its asking for info