I have an rb4011 with the latest stable of 7.12.1 running on it.
While debugging a PPP-session problem, I found that the router is actively making DHCP discoveries on the PPPoE interface. It’s weird, as having a DHCP client running on that interface is meaningless. The router does not have any DHCP-client defined or running ‘officially’. The command /ip/dhcp-client/export produces no lines.
Later on, I found out that the router is making DHCP discoveries on ALL of its ethernet-like interfaces, even on VLAN interfaces.
I thought, let’s try to offer an address for it then and see what will happen. So I fired up a dnsmasq in a VLAN dedicated to this purpose. The DHCP discovery requests appeared on the new VLAN interface as well. It was no surprise to me that the router had tried and successfully acquired an address. It then began sending DNS requests. See the following dump made on the Linux host (with the address of 192.168.0.1) in the VLAN running dnsmasq:
09:52:48.631222 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 08:55:31:83:a5:67, length 300
09:52:49.636130 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 08:55:31:83:a5:67, length 300
09:52:50.641076 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 08:55:31:83:a5:67, length 300
09:52:51.645644 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 08:55:31:83:a5:67, length 300
09:52:51.646274 ARP, Request who-has 192.168.0.75 tell 192.168.0.1, length 28
09:52:52.650787 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 08:55:31:83:a5:67, length 300
09:52:52.662473 ARP, Request who-has 192.168.0.75 tell 192.168.0.1, length 28
09:52:53.655132 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 08:55:31:83:a5:67, length 300
09:52:53.675857 ARP, Request who-has 192.168.0.75 tell 192.168.0.1, length 28
09:52:54.650831 IP 192.168.0.1 > 192.168.0.75: ICMP echo request, id 7125, seq 0, length 28
09:52:54.650990 IP 192.168.0.1.67 > 192.168.0.75.68: BOOTP/DHCP, Reply, length 300
09:52:54.651298 IP 192.168.0.1.67 > 192.168.0.75.68: BOOTP/DHCP, Reply, length 300
09:52:54.651572 IP 192.168.0.1.67 > 192.168.0.75.68: BOOTP/DHCP, Reply, length 300
09:52:54.651891 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 08:55:31:83:a5:67, length 300
09:52:54.652289 IP 192.168.0.1.67 > 192.168.0.75.68: BOOTP/DHCP, Reply, length 300
09:52:54.652669 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 08:55:31:83:a5:67, length 300
09:52:54.656770 IP 192.168.0.1.67 > 192.168.0.75.68: BOOTP/DHCP, Reply, length 300
09:52:54.700750 ARP, Request who-has 192.168.0.1 tell 192.168.0.75, length 42
09:52:54.700774 ARP, Reply 192.168.0.1 is-at 10:65:30:f1:9d:a9, length 28
09:52:54.702275 IP 192.168.0.75.5678 > 1.1.1.1.53: 26999+ A? cloud.mikrotik.com. (36)
09:52:54.702422 IP 192.168.0.75.5678 > 8.8.8.8.53: 5910+ A? cloud.mikrotik.com. (36)
09:52:55.702511 IP 192.168.0.75.5678 > 1.1.1.1.53: 26999+ A? cloud.mikrotik.com. (36)
09:52:55.703098 IP 192.168.0.75.5678 > 8.8.8.8.53: 5910+ A? cloud.mikrotik.com. (36)
^C
Guess what. This new IP address of 192.168.0.75 the router had acquired does not show up in CLI or in WinBox. I can not ping it, can not SSH to it, but the router still replies to ARPping queries for this ‘ghost IP-address’.
Clearly, we have some misconfigured DHCP-client running in the background.
Anyone else experiencing this?