Guest User!

You are not Sophos Staff.

Thread Info
  • State Not Answered
  • Locked Locked
  • Replies 0 replies
  • Subscribers 26 subscribers
  • Views 3709 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

How to prevent dhcp relay from spamming the dhcp server?

BorisBehrens

Hi,

we use the XG210 (SFOS 15.01.0 MR-3). We use the build in dhcp relay to forward dhcp request to our main dhcp server. And it seems that those request are multiplied.

See Logfile (Mac and IP adresses where changed): http://pastebin.com/8LjsuGLE
There are a couple thousand times this entry:

Jul 12 12:52:28 dhcpd[15895]: DHCPINFORM from 172.17.4.238 via 172.17.254.254
Jul 12 12:52:28 dhcpd[15895]: DHCPACK to 172.17.4.238 (01:23:45:67:89:0a) via eth0

tshark show a couple of uncountable request from the sophos to our dhcp server and the same amount of answers from the dhcp server to the client. It looks like:

22785 8.067716634 172.16.100.254 -> 172.16.100.67 DHCP 342 DHCP Inform - Transaction ID 0x73f63283
22786 8.067717960 172.16.100.254 -> 172.16.100.67 DHCP 342 DHCP Inform - Transaction ID 0x73f63283
22787 8.067759642 172.16.100.254 -> 172.16.100.67 DHCP 342 DHCP Inform - Transaction ID 0x73f63283
22788 8.067760984 172.16.100.254 -> 172.16.100.67 DHCP 342 DHCP Inform - Transaction ID 0x73f63283
22789 8.067762398 172.16.100.254 -> 172.16.100.67 DHCP 342 DHCP Inform - Transaction ID 0x73f63283
22790 8.067763724 172.16.100.254 -> 172.16.100.67 DHCP 342 DHCP Inform - Transaction ID 0x73f63283
22791 8.067765003 172.16.100.254 -> 172.16.100.67 DHCP 342 DHCP Inform - Transaction ID 0x73f63283
24692 8.085827634 172.16.100.67 -> 172.17.4.238 DHCP 342 DHCP ACK - Transaction ID 0x73f63283
24693 8.085850469 172.16.100.254 -> 172.16.100.67 DHCP 342 DHCP Inform - Transaction ID 0x73f63283
24694 8.085942178 172.16.100.67 -> 172.17.4.238 DHCP 342 DHCP ACK - Transaction ID 0x73f63283
24695 8.086020304 172.16.100.67 -> 172.17.4.238 DHCP 342 DHCP ACK - Transaction ID 0x73f63283
24696 8.086098342 172.16.100.67 -> 172.17.4.238 DHCP 342 DHCP ACK - Transaction ID 0x73f63283
24697 8.086176385 172.16.100.67 -> 172.17.4.238 DHCP 342 DHCP ACK - Transaction ID 0x73f63283
24698 8.086256098 172.16.100.67 -> 172.17.4.238 DHCP 342 DHCP ACK - Transaction ID 0x73f63283
24699 8.086305168 172.16.100.67 -> 172.17.4.238 DHCP 342 DHCP ACK - Transaction ID 0x73f63283

It repeats a thousand times.

Any ideas?



This thread was automatically locked due to age.