Take the 2-minute tour ×
Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

I am seeing extreme amount of network traffic on a host despite it should be idle. When I do

tcpdump -nni eth0 not net 10.10.10.10/32

I get lots of these

14:36:07.851048 IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from xx:xx:xx:xx:xx:xx, length 300

Question

Port 67 is for DHCP request. What could a reason be that the host with the crossed out MAC address is sending out so many requests?

share|improve this question
1  
Define "extreme amount". How many packets per second, exactly? –  Warren Young Oct 15 '13 at 13:22

1 Answer 1

up vote 5 down vote accepted

This is DHCP broadcast traffic and is expected on a network on which you're running a DHCP server. This is a broadcast request from a client, as can be ascertained by the fact that it's destination is port 67, which is server-bound DHCP.

If it had been going to port 68, it would have been client-bound. However, the DHCP server would typically be targetting a particular host and wouldn't need to send to the broadcast address in this case.

share|improve this answer
    
Why is it sending out so many? I don't see other DHCP clients do that? Is it a miss configured dhcp client? –  Sandra Oct 15 '13 at 12:51
1  
It may be misconfigured, I wouldn't expect to see a lot of this unless it isn't get an answer back from the DHCP server. Is it possible that the client has a firewall or some other security causing it to drop the DHCP server's response? Alternatively, is there an actual DHCP server on the network? If so, is it definitely responding at the moment, if you force a lease renewal on one of your systems? –  Ruairi Oct 15 '13 at 12:54
    
The host is a desktop computer, so it could be a firewall problem, as you say. There is a DHCP server on the network, and dhclient -r gives me a new IP, so it should be responding. –  Sandra Oct 15 '13 at 13:05
1  
At this stage your best bet is going to be to look for packets going back from the DHCP server towards the client. Running tcpdump on the client should tell you whether or not the client is seeing them. If not, check on the DHCP server to make sure that they are being sent. The DHCP server may not be responding to this client for some reason, also. Good luck! :) –  Ruairi Oct 15 '13 at 13:13
3  
Another clue that it's a DHCP client discover broadcast is the fact that the source address is 0.0.0.0 (because the client doesn't yet have an ip address) and the destination address is 255.255.255.255 (the layer 2 broadcast address). –  joeqwerty Oct 15 '13 at 13:14

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.