DHCPOFFER sent to wrong MAC?

[Simon Hobson]

Jason Lixfeld wrote:
>I have isc-dhcpd-3.0.4 installed via FreeBSD ports on a 6.1-RELEASE-
>p3 machine with a custom kernel.
>
>My dhcp server is at 00:50:04:d1:c9:f0
>My dhcp client is at 00:11:a0:02:67:36
>
>The dhcp server logs show constant discover/offer pairs, but the 
>client does not respond with a request, etc...
>
>Aug 17 14:35:59 bubbles dhcpd: DHCPDISCOVER from 00:11:a0:02:67:36 
>via xl0
>Aug 17 14:35:59 bubbles dhcpd: DHCPOFFER on 192.168.100.249 to 
>00:11:a0:02:67:36 via xl0
>Aug 17 14:36:01 bubbles dhcpd: DHCPDISCOVER from 00:11:a0:02:67:36 
>via xl0
>Aug 17 14:36:01 bubbles dhcpd: DHCPOFFER on 192.168.100.249 to 
>00:11:a0:02:67:36 via xl0
>Aug 17 14:36:03 bubbles dhcpd: DHCPDISCOVER from 00:11:a0:02:67:36 
>via xl0
>Aug 17 14:36:03 bubbles dhcpd: DHCPOFFER on 192.168.100.249 to 
>00:11:a0:02:67:36 via xl0
>
>I span'd the port on my switch which the dhcp server is connected to, 
>and ran ethereal on it and noticed this:
>
># Discover
><snip>
>Ethernet II, Src: VtechEng_02:67:36 (00:11:a0:02:67:36), Dst: 
>Broadcast (ff:ff:ff:ff:ff:ff)
>      Destination: Broadcast (ff:ff:ff:ff:ff:ff)
>      Source: VtechEng_02:67:36 (00:11:a0:02:67:36)
></snip>
>
># Offer
><snip>
>Ethernet II, Src: 3com_d1:c9:f0 (00:50:04:d1:c9:f0), Dst: 
>Cisco_bb:c6:a1 (00:05:9b:bb:c6:a1)
>      Destination: Cisco_bb:c6:a1 (00:05:9b:bb:c6:a1)
>      Source: 3com_d1:c9:f0 (00:50:04:d1:c9:f0)
></snip>
>
>It's sending the offer to the wrong MAC address.  00:05:9b:bb:c6:a1 
>is the MAC address of my default gateway router.
>
>Is this a configuration glitch on my end or is something else wrong?
>All clients appear to be affected similarly.

Just a stab in the dark, do you have a spurious routing table entry 
directing 255.255.255.255 via the router ?

Simon