Community discussions

MikroTik App
  4. RouterOS
  5. General

default offering lease without success

Post Reply
 
User avatar
acruhl
Member
Member
Topic Author
Posts: 371
Joined: Fri Jul 03, 2015 7:22 pm

default offering lease without success

Sat Jan 13, 2018 7:26 pm

I have a hAP-Lite with a dhcp-server problem.

My problem is the same as this one, but none of the "solutions" in this thread have worked:

viewtopic.php?f=13&t=119702&hilit=dhcp+without+success

I tried setting to the dhcp-server to authoritative, I tried disabling bootp.

My log is getting spammed with these messages quite often:
Code: Select all
default offering lease 192.168.22.209 for CC:35:40:04:38:1B to BC:8C:CD:46:15:F4 without success
default offering lease 192.168.22.206 for 08:95:2A:B8:EC:86 to BC:8C:CD:46:15:F4 without succes
It's only these 2 messages, but over and over.

At one point I see an incomplete ARP for those IPs but there is never an associated MAC.

Can someone tell me what this means?

These are happening at another place, I have to go over there to work on it at some point. Power off devices until I figure out what is doing this.
Top
 
User avatar
acruhl
Member
Member
Topic Author
Posts: 371
Joined: Fri Jul 03, 2015 7:22 pm

Re: default offering lease without success

Sat Jan 13, 2018 11:34 pm

Ok, I have a bit more information.

I wiresharked this and I see a DHCP Discover frame sent from the BC:8C:CD:46:15:F4 MAC address, but in the DHCP options it's setting the "client" MAC address to CC:35:40:04:38:1B. Or the other MAC 08:95:2A:B8:EC:86 in another DHCP Discover frame.

This seems like crappy behavior from one of the DHCP clients on WiFi, specifically the one with MAC BC:8C:CD:46:15:F4.

If I search on BC:8C:CD:46:15:F4, I can see this device (192.168.223.85) doing all kinds of stuff, including trying to communicate with a random (or not?) source APIPA address, SSDP, UDP from a source address of 1.1.1.1, etc. Seems like not such a polite client to me.

Has anyone seen anything like that?
Top
 
lambert
Long time Member
Long time Member
Posts: 548
Joined: Fri Jul 23, 2010 1:09 am

Re: default offering lease without success

Sun Jan 14, 2018 2:12 am

That appears to be a Samsung MAC address "BC:8C:CD:46:15:F4".

Maybe you know which device on your network might have a samsung manufactured interface? Does 192.168.223.85 have a web interface?

It sounds a bit like an AP or range extender which may be trying, unsuccessfully, to ARP "NAT" the original devices's DCHP requests.

Until we know what the device is, the crystal ball is foggy.
Top
 
User avatar
acruhl
Member
Member
Topic Author
Posts: 371
Joined: Fri Jul 03, 2015 7:22 pm

Re: default offering lease without success

Sun Jan 14, 2018 11:05 pm

Good call. I used to have a wifi extender and it did all kinds of wackiness. When I get over there I'll check it.
Top
 
User avatar
acruhl
Member
Member
Topic Author
Posts: 371
Joined: Fri Jul 03, 2015 7:22 pm

Re: default offering lease without success

Mon Feb 26, 2018 6:04 am

Ok, I'm resurrecting this topic.

I finally got to the place where this device exists, and it's a DirecTV DVR/set top box thing. It's apparently doing something on behalf of 2 other "slave" or "client" boxes in other rooms.

Super, duper annoying.

So I did this:
Code: Select all
/system logging set 2 topics=warning,!dhcp
And this suppressed the most common messages.

However, I believe this disables all warning level dhcp messages, which I don't want. Is there a way to match a regex only and drop it? I'm not finding it in the logging part of the wiki.

There are also some info messages that I would want to turn off:

feb/25 20:43:08 dhcp,info default assigned 192.168.22.19 to CC:03:FA:98:6A:FF
feb/25 20:43:08 dhcp,info default assigned 192.168.22.209 to CC:35:40:04:38:1B

I don't want to turn off all dhcp info messages as well as warning.
Top
 
User avatar
CZFan
Forum Guru
Forum Guru
Posts: 2098
Joined: Sun Oct 09, 2016 8:25 pm
Location: South Africa, Krugersdorp (Home town of Brad Binder)
Contact:
Contact CZFan

Re: default offering lease without success

Mon Feb 26, 2018 11:16 am

This is what I do:
Code: Select all
set 0 topics=info,!dhcp
Top
 
User avatar
acruhl
Member
Member
Topic Author
Posts: 371
Joined: Fri Jul 03, 2015 7:22 pm

Re: default offering lease without success

Mon Feb 26, 2018 5:55 pm

Yeah. I was really hoping to drop log messages based on a regexp string so I don't drop everything from DHCP.

I'll try it. Thanks.
Top
 
User avatar
CZFan
Forum Guru
Forum Guru
Posts: 2098
Joined: Sun Oct 09, 2016 8:25 pm
Location: South Africa, Krugersdorp (Home town of Brad Binder)
Contact:
Contact CZFan

Re: default offering lease without success

Mon Feb 26, 2018 7:13 pm

Yeah. I was really hoping to drop log messages based on a regexp string so I don't drop everything from DHCP.

I'll try it. Thanks.
My suggestion does not drop everything DHCP, only DHCP info, you will still get DHCP Warnings, etc
Top
 
lambert
Long time Member
Long time Member
Posts: 548
Joined: Fri Jul 23, 2010 1:09 am

Re: default offering lease without success

Mon Feb 26, 2018 7:27 pm

I think he mainly wants to get rid of this type of message:
Code: Select all
default offering lease 192.168.22.209 for CC:35:40:04:38:1B to BC:8C:CD:46:15:F4 without success
The info,!dhcp would get rid of the lease renewal messages which he also wants to hide. There may be other info level messages he wants to keep. I haven't looked at the DHCP server info output closely lately.

acruhl,

I think your best bet is to log to a syslog server and do filtering there. MikroTik does not give you that much granularity in the system. The more non-routing related features they add in the more likely the system is to become unstable. Once the logs go to a syslog server you can use something like logwatch to bring the stuff that is important to you to your inbox. That way you are not manually scanning the logs all day long. You also get to keep the full logs so that you can forensically figure out arcane issues which your users report.

This is getting off topic.
Top
 
User avatar
acruhl
Member
Member
Topic Author
Posts: 371
Joined: Fri Jul 03, 2015 7:22 pm

Re: default offering lease without success

Mon Feb 26, 2018 8:54 pm

I bet my left nut you are using some crappy repeaters or a device for switch, that (firmware) is not meant to be a switch. Or connected a freaking Sonos device that makes a loop...
Even a laptop, connected both wired and wireless will get 2 separate IPs without problems. Running xp/7/Linux/BD/whatever. Tested that, know that for sure.
Ahh, no, it's a DirecTV set top box, like I said. I'm sure lots of devices create a lot of chatter. This one is particularly annoying.
Top
 
User avatar
acruhl
Member
Member
Topic Author
Posts: 371
Joined: Fri Jul 03, 2015 7:22 pm

Re: default offering lease without success

Mon Feb 26, 2018 8:58 pm

I think he mainly wants to get rid of this type of message:
Code: Select all
default offering lease 192.168.22.209 for CC:35:40:04:38:1B to BC:8C:CD:46:15:F4 without success
The info,!dhcp would get rid of the lease renewal messages which he also wants to hide. There may be other info level messages he wants to keep. I haven't looked at the DHCP server info output closely lately.

acruhl,

I think your best bet is to log to a syslog server and do filtering there. MikroTik does not give you that much granularity in the system. The more non-routing related features they add in the more likely the system is to become unstable. Once the logs go to a syslog server you can use something like logwatch to bring the stuff that is important to you to your inbox. That way you are not manually scanning the logs all day long. You also get to keep the full logs so that you can forensically figure out arcane issues which your users report.

This is getting off topic.
Yes, you're right. I don't want to suppress a whole class of messages to get rid of one.

A syslog server is overkill for this situation but probably the correct solution.
Top
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1782
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: default offering lease without success

Mon Feb 26, 2018 9:21 pm

Maybe one of these:
* what if you where to configure this box to static ip? your internal network addressing is stable I assume
* or since the offers are unsuccessful, create a "lease" definition and "block-access=yes"
* drop in firewall any packets matching the desired mac
Top
 
User avatar
acruhl
Member
Member
Topic Author
Posts: 371
Joined: Fri Jul 03, 2015 7:22 pm

Re: default offering lease without success

Mon Feb 26, 2018 10:45 pm

Yeah, that's worth a try next time I'm over there. Setting a static IP is a good start probably. The real problem is I don't know exactly why it's doing this stuff or if it's necessary for it's functionality. In the end the "problem" might only be that MikroTik likes to log messages that this impolite device causes.
Top
 
User avatar
CZFan
Forum Guru
Forum Guru
Posts: 2098
Joined: Sun Oct 09, 2016 8:25 pm
Location: South Africa, Krugersdorp (Home town of Brad Binder)
Contact:
Contact CZFan

Re: default offering lease without success

Mon Feb 26, 2018 10:50 pm

set 0 topics=info,!dhcp
MTCNA, MTCTCE, almost MTCRE :-)
Overcertified?
I have watching some of your posts, if you have something to say, spit it out
Top
 
User avatar
sebastia
Forum Guru
Forum Guru
Posts: 1782
Joined: Tue Oct 12, 2010 3:23 am
Location: Antwerp, BE

Re: default offering lease without success

Mon Feb 26, 2018 11:42 pm

I have watching some of your posts, if you have something to say, spit it out
Ignore it, probably an attention junkie ;)
Top
 
SergeS
Frequent Visitor
Frequent Visitor
Posts: 67
Joined: Fri Mar 25, 2016 6:23 am

Re: default offering lease without success

Sat Sep 29, 2018 7:43 pm

Will ask here to not make another topic, subject is very similar...
<...>
Update: post removed, problem solved, it was a bug in client firmware, Mikrotik is not guilty.
Top
Post Reply

Who is online

Users browsing this forum: Bing [Bot], eworm, GoogleOther [Bot], stef70 and 128 guests
  4. RouterOS
  5. General