Something wrong with my DHCP? Discover and Offer every minute

Not sure what's going on here. Not very knowledgeable about DHCP, familiar with the basics. Have a home system of a separate router box on 19.07.3, and a dumb AP providing the wifi.

Lately I've been getting tons of this in my syslog:

Thu Jun 25 16:14:55 2020 daemon.info dnsmasq-dhcp[28156]: DHCPDISCOVER(br-lan) 00:26:ab:xx:xx:xx
Thu Jun 25 16:14:55 2020 daemon.info dnsmasq-dhcp[28156]: DHCPOFFER(br-lan) 192.168.1.170 00:26:ab:xx:xx:xx
Thu Jun 25 16:14:55 2020 daemon.info dnsmasq-dhcp[28156]: DHCPDISCOVER(br-lan) 00:26:ab:xx:xx:xx
Thu Jun 25 16:14:55 2020 daemon.info dnsmasq-dhcp[28156]: DHCPOFFER(br-lan) 192.168.1.170 00:26:ab:xx:xx:xx
Thu Jun 25 16:14:56 2020 daemon.info dnsmasq-dhcp[28156]: DHCPDISCOVER(br-lan) 00:26:ab:xx:xx:xx
Thu Jun 25 16:14:56 2020 daemon.info dnsmasq-dhcp[28156]: DHCPOFFER(br-lan) 192.168.1.170 00:26:ab:xx:xx:xx

OK, sounds like someone is asking for an address, and dnsmasq is offering an IP. And, whatever it is, isn't taking it and asking again? Am I correct? This happens in a burst like this, every minute.

The odd to me part was when I tried to find the device. Of course, not in the DHCP list, it didn't take the address. I did find it in luci Realtime Graphs, in the Connections graph that has a list of current connected devices. Seems the device is the router itself??

In Realtime Graphs, Connections:
 
Network	Protocol	Source		Destination		Transfer	
IPV4	ICMP		192.168.1.1	192.168.1.170		48 B (1 Pkts.)

IPV4	UDP		192.168.1.1:67	192.168.1.170:68	984 B (3 Pkts.)

IPV4	UDP		Router.lan:67	192.168.1.170:68	984 B (3 Pkts.)

The last line is a repeat of the middle line, with the domain name lookup turned on.

So, is this extremely wierd, somehow normal, or something else? And, where do I go from here?

Yes, it looks like some device is asking for an IP address, and ignoring (or not receiving) the answer. I would first make sure which device is that, using the MAC address.

If it is really the router itself, you should check the configuration files, that is not a normal situation.

You can find out the MAC of the router with ip link. Or look at the Luci under Network-Interfaces.
What you see in the Realtime graphs is normal. Your OpenWrt is 192.168.1.1 and on udp/67 runs the dhcp server. One dhcp client from udp/68 is connected to it.

OK, I have determined that none of the router's MAC's are the one in question.

I have also found that this 192.168.1.170 address shows up SOMETIMES in the ARP tables llist, as in, it wont be there, then if you refresh a few times, it will, then it's gone again.... Looks like it gets assigned momentarily, then it's gone? Shouldn't there be a log entry showing that IP was handed out?

I also never see it in the DHCP leases list.

I see now, Trendy, that the Realtime graphs output would be normal, except that the connected client is the connected/not connected .170 one that I'm wondering about. It also looks like just a few packets, vs trying 4 times a second every minute.

Maybe I should add that I had seen weird things before, where the DHCP was apparently trying to hand out addresses to the cable modem out on the WAN side (?!) to the AP, and other drop/up behavior on the router eth lan port. And, that was all during the time I was running 19.07.1. I just updated it (after 137d uptime!) to 19.07.3, and so far haven't seen that earlier behavior. I have about 6d of uptime now, and I didn't see this at the start, just in the last day or two.

What next?

The MAC is for an Epson printer

1 Like

Another thing, both on the router and the AP, I see in the ip link results that the br-lan and a real hardware port share the same MAC. Is this expected behavior?

WOW... mbo2o, you nailed it!

I had forgotten that I had pulled off the shelf an old printer to scan something a couple of days ago, got distracted, and left it sitting under the table, plugged in. I even forgot it had wifi capability, always had plugged it in via USB... And, after trying several times to complete a wifi setup with it, I see why I forgot about that, it seems broken...

I think it's broken in more than just you cant get it to give the wifi password and work kind of way, if it's trying to get an IP even before you put a password into it for it to offer up... Maybe I'll see if there's a firmware update, or maybe I'll just scan those few docs and unplug it when I'm done...

And mbo2o, I didn't know you could look up MAC's... where did you find listings by manufacturers??

Solution: Misbehaving device on network causing problems, was not a OpenWrt DHCP problem.

1 Like

just google "mac vendor"

2 Likes

At least now put a post-it note on the printer that wifi is malfunctioning!

Yep, looks like there's a ton of search sites for MAC address blocks... Somehow, that didn't occur to me.

I guess eduperez nailed it, I didn't realize it at first... Thanks, guys.
Looks like there's no new firmware/software for an old Epson NX420... so I guess it stays this way. Doesn't seem to be a way to disable the wifi, either. So, it's unplug and put it back on the shelf, till the next time I need to scan something.

Trendy... yeah, really!! Then, maybe I won't forget and go thru this again in a year or so... :roll_eyes:

Anyone interested in seeing what's on the AP side, not sure if I'm seeing oddness in how the wifi logon is working... or is that better in a new thread? Since I'm running a snapshot on the AP, maybe there's something to find there...

At least do factory reset of the printer

This topic was automatically closed 10 days after the last reply. New replies are no longer allowed.