<div dir="ltr"><div class="gmail_extra"><br><div class="gmail_quote">On Thu, May 5, 2016 at 10:51 AM, Patrick Trapp <span dir="ltr"><<a href="mailto:ptrapp@nex-tech.com" target="_blank">ptrapp@nex-tech.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">Do the 300-ish devices share anything in particular in their configurations? Is the configuration you shared pertinent to some of your culprits?<br>
<br>
Can you confirm that the ACK are reaching the devices? Do any of the devices lose their address entirely and have to be rebooted to get back on the network or is this issue literally only apparent to you and your logs?<br>
<br>
Patrick<br>
<br>
________________________________________<br>
From: <a href="mailto:dhcp-users-bounces@lists.isc.org">dhcp-users-bounces@lists.isc.org</a> [<a href="mailto:dhcp-users-bounces@lists.isc.org">dhcp-users-bounces@lists.isc.org</a>] on behalf of Alex Moen [<a href="mailto:alexm@ndtel.com">alexm@ndtel.com</a>]<br>
Sent: Thursday, May 05, 2016 9:40 AM<br>
To: <a href="mailto:dhcp-users@lists.isc.org">dhcp-users@lists.isc.org</a><br>
Subject: DHCPREQUEST flooding<br>
<div class="HOEnZb"><div class="h5"><br>
I am running a 4.2.5 ISC DHCP server (up-to-date via Centos 7<br>
repository) for our ISP business. We have around 7000 subscribers; most<br>
with an el-cheapo router, a few with no router at all. Most of our<br>
customers are using a variant of Linksys router (Linksys, Cisco-Linksys,<br>
Belkin, etc) because that is what we provide if they ask for a router.<br>
However, this issue is not only a Linksys issue, as we are also seeing<br>
PCs exhibiting the same behavior.<br>
<br>
The issue is that we have a fairly large number of devices (around 300)<br>
that are issuing DHCPREQUESTs at extremely short intervals (the worst, a<br>
few second apart). In the last 6 hours, some of these devices have<br>
REQUESTed over 2000 times. They are all being ACKed.<br>
<br>
Is this a common problem that everyone sees, or do I have a config<br>
issue? This has actually been going on for a long, long time, and I am<br>
just tired of the large log file sizes. Since we're an ISP, we have to<br>
keep our logs for a few years time, so the log file size can become an<br>
issue.<br>
<br>
A typical network stanza looks like:<br>
<br>
subnet 76.10.94.0 netmask 255.255.254.0 {<br>
pool {<br>
authoritative;<br>
range 76.10.94.20 76.10.95.200;<br>
min-lease-time 129600;<br>
max-lease-time 259200;<br>
default-lease-time 259200;<br>
option subnet-mask 255.255.254.0;<br>
option broadcast-address 76.10.95.255;<br>
option routers 76.10.94.1;<br>
}<br>
}<br>
<br>
Thanks for any input!!<br>
<br>
Alex<br>
_______________________________________________<br></div></div></blockquote><div><br></div><div>Are you using failover? In failover mode, the first lease will be a shorter (mclt) time, but that should not affect renewals.</div><div><br></div><div>-- </div><div>Bob Harold</div><div> </div></div></div></div>