MAC address schizm!
Network Administration
joseph at alyrica.net
Thu Dec 1 22:51:56 UTC 2005
Hello,
My network consists of a couple hundred users spread out over a wide geographic area. About 80 of these users are connecting to me via a bridge that operates in a special "single MAC address" mode -- in other words, the network "bridge" between me and the user takes the ethernet MAC from all outgoing packets, and rewrites it with it's own MAC. For example (from an earlier tcpdump):
10:26:33.187935 00:00:8f:28:aa:fd > ff:ff:ff:ff:ff:ff, ethertype IPv4 (0x0800), length 590: IP 0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from 00:13:10:6a:72:20, length: 548
As you can see, a device on this network (00:13:10:6a:72:20) is requesting a DHCP lease. The "From" MAC address is different, though (00:00:8f:28:aa:fd).
Until last week, I was using dhcpd 3.0.1. It replies with a DHCP reply to the packet "from" MAC, 00:00:8f:28:aa:fd. The 3.0.3 version that I just installed, however, is trying to reply to the MAC contained within the DHCP packet (00:13:10:6a:72:20):
10:26:33.188165 00:06:25:07:4d:a6 > 00:13:10:6a:72:20, ethertype IPv4 (0x0800), length 342: IP 65.197.143.193.67 > 192.168.123.219.68: BOOTP/DHCP, Reply, length: 300
This fails miserably, because the quasi-bridge units are all expecting to recieve packets at their respective MAC addresses, the addresses that they are stamping onto the packets that pass through them. They don't expect that someone will detect and use a MAC from a device hidden behind them (they are not true bridges, obviously).
Does anyone know of a configuration directive that I can use to revert to the earlier method of replying to DHCP packets? When was this changed? The old dhcpd that I have probably came from an earlier 2.2 or 2.4 linux, likely a debian package. The 3.0.3 that I am using was compiled under 2.6.13.2 for AMD 64bit.
Cheers,
Joseph
More information about the dhcp-hackers
mailing list