DHCP flooding my router

[randomName]

I have one PC on my LAN, wired that is flooding the 'General Log' DHCP REQUEST, INFORM, ACK, every 3 seconds. The other wired PC doesn't. What is going on?

 

[Pericynthion]

You only have 2 wired PC's connected? (so no wireless?)
I would check the cable initially and then after that the card in the PC.

When you see the REQUEST come in, does it already have an IP address in that message?

The request/inform with an address implies that the PC is DHCPing for an address it already has - which it should only do >50% through the lease time to make sure that the same address will be re-issued when the lease expires.

If it was asking for a new address I'd say the IP stack was re-initializing, but if you still have an address you either have a very, very short lease time or there is something forcing the linkup/down.

If you only have 2 machines, to be honest - I'd set them as static IP addresses and disable DHCP altogether. (sorry, I may have misunderstood the questions)

 

[randomName]

Actually 1 PC is on that router. The other is behind my secondary router. Yeah. Sometimes it would be every 3 seconds or so, same ip. I did move the card from the one slot to the other and it seems to be a little bit more stable.

I thought I had them static or manually inserted addresses. I think I forgot to manually set the IP on the cards..

 

[Fraoch]

Would it be related to this?

http://brielle.sosdg.org/archives/522-Windows-7-flooding-DHCP-server-with-DHCPINFORM-messages.html

 

[randomName]

Would it be related to this?

http://brielle.sosdg.org/archives/522-Windows-7-flooding-DHCP-server-with-DHCPINFORM-messages.html

That's exactly it! Wow! Hmmm, now how do i implement that into my dnsmasq.conf file? I have no idea. I'm a noob at these things.

Thanks

 

[VinceV]

That's exactly it! Wow! Hmmm, now how do i implement that into my dnsmasq.conf file? I have no idea. I'm a noob at these things.

Thanks

You should be able to add the line:

dhcp-option=252,"\n"

to your /jffs/configs/dnsmasq.conf.add file:

1. Enable and format the JFFS partition if it isn't already (Administration->System) and reboot
2. Go to Tools->Run Cmd
3. Execute this command: sh -c 'echo dhcp-option=252,\"\\n\">>/jffs/configs/dnsmasq.conf.add&&echo Success'
4. If you get an error, your JFFS partition isn't successfully enabled and formatted.
5. Reboot the router

DISCLAIMER: I have not tried this. Don't blame me if something breaks.

-Vince

 

[joegreat]

DISCLAIMER: I have not tried this. Don't blame me if something breaks.

Hi,

I can confirm that it works like a charm (I mean putting the option into the config file)!

With kind regards
Joe

 

[RMerlin]

You should be able to add the line:

dhcp-option=252,"\n"

to your /jffs/configs/dnsmasq.conf.add file:

1. Enable and format the JFFS partition if it isn't already (Administration->System) and reboot
2. Go to Tools->Run Cmd
3. Execute this command: sh -c 'echo dhcp-option=252,\"\\n\">>/jffs/configs/dnsmasq.conf.add&&echo Success'
4. If you get an error, your JFFS partition isn't successfully enabled and formatted.
5. Reboot the router

DISCLAIMER: I have not tried this. Don't blame me if something breaks.

-Vince

Out of curiosity, can someone try instead to specify this?

dhcp-option=252,"http://router.asus.com/proxy.pac\n"

This is also untested. Asuswrt does support proxy configuration, I wonder if pointing to the (usually missing) location would also fix things, or create a different problem. If it works 100%, I could make this a default setting in dnsmasq.conf.

 

[VinceV]

Out of curiosity, can someone try instead to specify this?

dhcp-option=252,"http://router.asus.com/proxy.pac\n"

This is also untested. Asuswrt does support proxy configuration, I wonder if pointing to the (usually missing) location would also fix things, or create a different problem. If it works 100%, I could make this a default setting in dnsmasq.conf.

Hmm, my router won't answer that request since I have HTTP disabled. When I try it over HTTPS, I get a 404... I'm thinking because my /www/proxy.pac is a symlink to a non-existent /www/ext/proxy.pac (/tmp/var/wwwext/proxy.pac)...

-Vince

 

[RMerlin]

Hmm, my router won't answer that request since I have HTTP disabled. When I try it over HTTPS, I get a 404... I'm thinking because my /www/proxy.pac is a symlink to a non-existent /www/ext/proxy.pac (/tmp/var/wwwext/proxy.pac)...

-Vince

That's correct. The symlink points to a location in RAM where someone can provide his own pac file. I'm just wondering if having dnsmasq provide that URL by default even if the user hasn't provided an actual pac file (or if you have http disabled) would still fix the issue without creating a new problem.

 

[RMerlin]

Note that pac support is broken in Asus's FW (as in it's only half-implemented - the mimetype is missing from the httpd), so this would only apply to Asuswrt-Merlin.

 

[VinceV]

That's correct. The symlink points to a location in RAM where someone can provide his own pac file. I'm just wondering if having dnsmasq provide that URL by default even if the user hasn't provided an actual pac file (or if you have http disabled) would still fix the issue without creating a new problem.

Gotcha. Thanks for the clarification. I'd be worried that the user's computers would continuously request the PAC file if you specify one and it isn't able to get it. It would be interesting to sniff some traffic and see what happens...

-Vince

 

[RMerlin]

Gotcha. Thanks for the clarification. I'd be worried that the user's computers would continuously request the PAC file if you specify one and it isn't able to get it. It would be interesting to sniff some traffic and see what happens...

-Vince

Good point. It wouldn't surprise me if the browser would try to look for that file every time you started IE for example.

 

[randomName]

I've set the devices on the 1st router to a static IP and manually set the IP addresses, and then turned off DHCP through the LAN settings. Since then they have stopped completely via checking the System Log\General Log\ Before I did that I switched the network's cards PCIe slots and the issue slowed down to what I think would at-least be "normal"

I still don't understand why it did all that in the first place.

Thanks everyone.

 

[Fraoch]

I still don't understand why it did all that in the first place.

It's a bug in Windows 7 - I saw this in another forum post somewhere.

I looked and looked for that forum post but couldn't find it. Apparently there is some setting you can set in Windows 7 that will stop this...

I thought for sure this was in the Ubiquiti forum for the EdgeRouter Lite - someone thought they were the victim of a DoS attack but it turned out it was his own Windows 7 PC.

 

[geko53]

Out of curiosity, can someone try instead to specify this?

dhcp-option=252,"http://router.asus.com/proxy.pac\n"

Just done - and it seems to work... No more flooding as far as I can see after 10 minutes.

Just to be able to learn something new: what does this setting do precisely? I don't have set up a proxy, btw...

Ciao
Gerald

 

[VinceV]

Just to be able to learn something new: what does this setting do precisely? I don't have set up a proxy, btw...

DHCP Option 252 is part of the Web Proxy Auto-Discovery Protocol defined in http://tools.ietf.org/html/draft-ietf-wrec-wpad-01. It specifies a PAC file which your browser can use to automatically configure it's proxy server settings. Since there isn't actually a valid PAC file at that URL, your browser isn't going to use a proxy server.

 

[krick]

Out of curiosity, can someone try instead to specify this?

dhcp-option=252,"http://router.asus.com/proxy.pac\n"

This is also untested. Asuswrt does support proxy configuration, I wonder if pointing to the (usually missing) location would also fix things, or create a different problem. If it works 100%, I could make this a default setting in dnsmasq.conf.

Was this ever added as a default setting?

 

[RMerlin]

Was this ever added as a default setting?

No, because I never got enough feedback to confirm it worked properly.