Mikrotik spams DHCP discover from all bridge ports

RouterOS General
1

Howdy, folks.
I have hAP ac^2 at home with ROS 7.11.2 installed.
While analyzing network traffic to troubleshoot other problem, I found out that router spams DHCP Discover packets to all bridge ports.

The configuration is quite simple:

  • ether1 with DHCP Client to get IP address from my ISP;


  • ether2-5 are in bridge and there’s DHCP server on that bridge interface for LAN/home devices.

I do not expect to see bridge interfaces (ether2-5) send any DHCP Discover messages as there’s no configured DHCP clients on them.
Any suggestions why it is happening?

2

I

I will assume this means.

  • no dhcp client configured on the Hap AC2 bridge.
  • there are external dhcp clients on the lan network.

The bridge by default mostly acts as a dumb switch, so dhcp broadcasts will exit all ports in the bridge except the one it came in on,
(including to the CPU switch port)

You can enable dhcp snooping on the bridge.

https://wiki.mikrotik.com/wiki/Manual:Interface/Bridge#DHCP_Snooping_and_DHCP_Option_82

This will likely stop the bridge being hardware offloaded.
You could possibly create some rules for the switch chip to prevent dhcp broadcasts going anywhere except the cpu port.

https://help.mikrotik.com/docs/display/ROS/Switch+Chip+Features#SwitchChipFeatures-RuleTable

3

The client cannot know where the DHCP server is in advance. Hence, DHCP requests are broadcast. What you’re seeing is expected.

You claim there are no DHCP clients on the LAN, but I suspect that if you dig into the packet and find the source MAC in one of these mystery DHCP requests, then track down who it belongs to, the mystery will solve itself.

4

Based on the symptoms I’d suspect you have enabled the internet detect feature.

To disable:

/interface detect-internet set detect-interface-list=none

Documentation here: https://help.mikrotik.com/docs/display/ROS/Detect+Internet


Note that Detect Internet can install DHCP clients, default routes, DNS servers and affect other facilities.
Use with precaution, and after enabling the service, check how it interferes with your other configuration.

5

you have enabled the internet detect feature

You are completely right. :confused: That was it. Disabled the Detect Internet and Discover spam stopped. I didn’t even checked if that feature is enabled on the device.
My big thanks to you and to everyone involved.