I have isc dhcpd v3 serving a local subnet. I have installed a rogue dhcp server detector (dhcp_probe) which constantly sends dhcp requests. These requests are logged by the legit dhcp server, filling up logs. While I can filter these logs with rsyslogd (iptables/arptables filtering does not work, as dhcp bypasses them: https://kb.isc.org/article/AA-00378/0/Why-does-DHCP-use-raw-sockets.html) it would be nice to cut the issue at the root. I've looked into dhcpd.conf manual page but could not find a way to exclude logging ("ignore booting" only makes dhcpd not respond to client, but it still logs) Is it possible to skip logging a specific mac?
Add a comment
|