Automatique and - unwelcome dhcp suffix change
-
Hi guys i just want to know do i have to worry because its the first time i see something like that happening so randomly??
at the 2:43:16 my link goes down then goes up again the probleme is that my dhcp addresse range is supposed to be 192.168.0.0/24 but suddenly it goes to 192.168.100.0/24
attack or bug ?
im running latest release of pfsenseupdate : (i should specify that its a pc (core2duo) with pfsense installed on it , and that the 30sec dhcp lease is part of the problems
my conf should be 120min and whit the address range 192.168.0.0/24)
to repair it i had to cut completly the wan connection then recover my last config that goes to 2month old
im the only one to have access physicly to the router and i have not change the setting since 2monthhere my log
Jan 31 02:42:08 dhcpd: DHCPOFFER on 192.168.0.9 to 00:17:88:19:49:5f via rl0
Jan 31 02:42:08 dhcpd: DHCPREQUEST for 192.168.0.9 (192.168.0.100) from 00:17:88:19:49:5f via rl0
Jan 31 02:42:08 dhcpd: DHCPACK on 192.168.0.9 to 00:17:88:19:49:5f via rl0
Jan 31 02:43:16 dhclient[90639]: ale0 link state up -> down
Jan 31 02:43:17 dhclient[84892]: connection closed
Jan 31 02:43:17 dhclient[84892]: exiting.
Jan 31 02:43:19 dhcpd: DHCPREQUEST for 192.168.0.14 from 00:0c:29:0d:e1:54 via rl0
Jan 31 02:43:19 dhcpd: DHCPACK on 192.168.0.14 to 00:0c:29:0d:e1:54 via rl0
Jan 31 02:43:37 dhclient: PREINIT
Jan 31 02:43:37 dhclient[144]: Corrupt lease file - possible data loss!
Jan 31 02:43:37 dhclient[144]: DHCPREQUEST on ale0 to 255.255.255.255 port 67
Jan 31 02:43:37 dhclient[144]: DHCPNAK from 192.168.100.1
Jan 31 02:43:37 dhclient[144]: DHCPDISCOVER on ale0 to 255.255.255.255 port 67 interval 2
Jan 31 02:43:37 dhclient[144]: DHCPOFFER from 192.168.100.1
Jan 31 02:43:37 dhclient: ARPSEND
Jan 31 02:43:39 dhclient: ARPCHECK
Jan 31 02:43:39 dhclient[144]: DHCPREQUEST on ale0 to 255.255.255.255 port 67
Jan 31 02:43:40 dhclient[144]: DHCPACK from 192.168.100.1
Jan 31 02:43:40 dhclient: BOUND
Jan 31 02:43:40 dhclient: Starting add_new_address()
Jan 31 02:43:40 dhclient: ifconfig ale0 inet 192.168.100.10 netmask 255.255.255.0 broadcast 192.168.100.255
Jan 31 02:43:40 dhclient: New IP Address (ale0): 192.168.100.10
Jan 31 02:43:40 dhclient: New Subnet Mask (ale0): 255.255.255.0
Jan 31 02:43:40 dhclient: New Broadcast Address (ale0): 192.168.100.255
Jan 31 02:43:40 dhclient: New Routers (ale0): 192.168.100.1
Jan 31 02:43:40 dhclient: Adding new routes to interface: ale0
Jan 31 02:43:40 dhclient: /sbin/route add default 192.168.100.1
Jan 31 02:43:40 dhclient: Creating resolv.conf
Jan 31 02:43:40 dhclient[144]: bound to 192.168.100.10 – renewal in 30 seconds.
Jan 31 02:44:07 dhclient[19331]: ale0 link state up -> down
Jan 31 02:44:10 dhclient[19331]: ale0 link state down -> up
Jan 31 02:44:10 dhclient[19331]: DHCPREQUEST on ale0 to 255.255.255.255 port 67
Jan 31 02:44:10 dhclient[19331]: DHCPREQUEST on ale0 to 192.168.100.1 port 67
Jan 31 02:44:12 dhclient[19331]: DHCPREQUEST on ale0 to 192.168.100.1 port 67
Jan 31 02:44:15 dhclient[19331]: DHCPREQUEST on ale0 to 192.168.100.1 port 67
Jan 31 02:44:17 dhcpd: Internet Systems Consortium DHCP Server 4.2.8
Jan 31 02:44:17 dhcpd: Copyright 2004-2015 Internet Systems Consortium.
Jan 31 02:44:17 dhcpd: All rights reserved.
Jan 31 02:44:17 dhcpd: For info, please visit https://www.isc.org/software/dhcp/
Jan 31 02:44:17 dhcpd: Internet Systems Consortium DHCP Server 4.2.8
Jan 31 02:44:17 dhcpd: Copyright 2004-2015 Internet Systems Consortium.
Jan 31 02:44:17 dhcpd: All rights reserved.
Jan 31 02:44:17 dhcpd: For info, please visit https://www.isc.org/software/dhcp/ -
Is that your WAN?
Some cable modems, especially Motorola surfboards, will hand out 192.168.100.x addresses with a 30sec lease when they have lost sync on the line with the cable provider.
Ostensibly that is so you can reach the modem to configure it during an outage, in reality it's a PITA to deal with. You can put "192.168.100.1" in the reject leases box on the WAN to stop it from accepting those requests.
