Certain DHCP Broadcasts being dropped?!? - Firewalls

This is a discussion on Certain DHCP Broadcasts being dropped?!? - Firewalls ; I recently noticed entries in the log of my SonicWall indicating that my Server 2003 SP1 DHCP server appears to be sending a DHCPOFFER broadcast once every minute. The entries look like this (server IP changed to protect the innocent): ...

+ Reply to Thread
Results 1 to 2 of 2

Thread: Certain DHCP Broadcasts being dropped?!?

  1. Certain DHCP Broadcasts being dropped?!?

    I recently noticed entries in the log of my SonicWall indicating that my
    Server 2003 SP1 DHCP server appears to be sending a DHCPOFFER broadcast once
    every minute. The entries
    look like this (server IP changed to protect the innocent):

    [Date & Time] - Broadcast packet dropped - Source:172.16.211.8, 67, LAN -
    Destination:255.255.255.255, 68, LAN - Protocol: 17 -

    Clients on my network are successfully requesting and receiving address
    assignments from the DHCP server, so I can't think of any reason why
    my firewall would consistently drop only these DHCPOFFER messages; I also
    can't figure out "who" the client might be that's sending the requests.
    Obviously the client request keeps coming every minute because the reply
    from the DHCP server is being dropped, but what the heck is going on here?

    - Who is the mystery client?
    - Why is the firewall dropping the DHCPOFFER message?
    - I have WPA/PSK security on my wireless network, but I can confirm that
    *no* clients at all are connected to the APs while this is occurring.

    Any help appreciated.

    Bryan



  2. Re: Certain DHCP Broadcasts being dropped?!?

    On Feb 13, 6:05 am, "BJ" wrote:
    > I recently noticed entries in the log of my SonicWall indicating that my
    > Server 2003 SP1 DHCP server appears to be sending a DHCPOFFER broadcast once
    > every minute. The entries
    > look like this (server IP changed to protect the innocent):
    >
    > [Date & Time] - Broadcast packet dropped - Source:172.16.211.8, 67, LAN -
    > Destination:255.255.255.255, 68, LAN - Protocol: 17 -
    >
    > Clients on my network are successfully requesting and receiving address
    > assignments from the DHCP server, so I can't think of any reason why
    > my firewall would consistently drop only these DHCPOFFER messages; I also
    > can't figure out "who" the client might be that's sending the requests.
    > Obviously the client request keeps coming every minute because the reply
    > from the DHCP server is being dropped, but what the heck is going on here?
    >
    > - Who is the mystery client?
    > - Why is the firewall dropping the DHCPOFFER message?
    > - I have WPA/PSK security on my wireless network, but I can confirm that
    > *no* clients at all are connected to the APs while this is occurring.
    >
    > Any help appreciated.
    >
    > Bryan


    Well.. do you have a workstation that cannot acquire an ip address?

    I would run a packet analyser like wireshark(ethereal) and see the mac
    address's involved then you can pinpoint where they are coming from.

    Flamer.


+ Reply to Thread