<html>
<head>
<meta http-equiv="Content-Type" content="text/html; charset=Windows-1252">
<meta name="Generator" content="Microsoft Exchange Server">
<!-- converted from text --><style><!-- .EmailQuote { margin-left: 1pt; padding-left: 4pt; border-left: #800000 2px solid; } --></style>
</head>
<body>
<div>
<div id="x_nine_body_n184af4-0b818" class="x_nine_body" dir="auto" style="font-family:Calibri,Arial,Helvetica,sans-serif; font-size:12.0pt; line-height:1.3; color:#1F497D">
<div class="x_nine-pg" dir="auto">Tina,</div>
<div class="x_nine-pg" dir="auto"><br>
</div>
<div class="x_nine-pg" dir="auto">As I am sure you are aware DHCPDISCOVER is a broadcast message. If you are getting these from networks that you do not administrate it would seem to suggest there are engineering flaws with the segmentation of the network
or the configuration of this new Huawei hardware.</div>
<div class="x_nine-pg" dir="auto"><br>
</div>
<div class="x_nine-pg" dir="auto">Based upon the wording of your email this extra traffic seems to coincide with the arrival of the new hardware so I would recommend you focus your troubleshooting efforts on that.</div>
<div class="x_nine-pg" dir="auto"><br>
</div>
<div class="x_nine-pg" dir="auto">Assuming your network is properly segmented then there is something in the Huawei config that is flipping WAN side broadcast traffic into your network.</div>
<div class="x_nine-pg" dir="auto"><br>
</div>
<div class="x_nine-pg" dir="auto">Good hunting.</div>
<div class="x_nine-pg" dir="auto"><br>
</div>
<div class="x_nine-pg" dir="auto">John</div>
<div class="x_nine-pg x_blank x_sign" dir="auto"><br>
</div>
<div id="x_nine-sign-n184af4-0b818" class="x_nine_signature" dir="auto">
<div class="x_nine-pg" dir="auto">Sent from <a href="http://www.9folders.com/" style="text-decoration:none; color:#009BDF">
Nine</a></div>
</div>
<div class="x_nine-pg x_blank x_msg" dir="auto"><br>
</div>
</div>
<div class="x_quoted_output_body">
<div id="x_quoted_header_n184af4-0b818" class="x_quoted_header_editor" dir="auto">
<hr style="border:none; height:1px; color:#E1E1E1; background-color:#E1E1E1">
<div dir="auto" style="border:none; padding:3.0pt 0cm 0cm 0cm"><span style="font-size:11.0pt; font-family:Calibri,Arial,Helvetica,sans-serif"><b>From:</b> Christina Siegenthaler <tina@ieu.uzh.ch><br>
<b>Sent:</b> Friday, November 25, 2022 8:34 AM<br>
<b>To:</b> dhcp-users@lists.isc.org<br>
<b>Subject:</b> DISCOVERs from "unkown network segment" - suppress log messages?<br>
</span></div>
</div>
<br type="attribution">
</div>
</div>
<font size="2"><span style="font-size:10pt;">
<div class="PlainText">Dear all<br>
<br>
<br>
Is there a possibility to suppress messages like this from being logged:<br>
<br>
Nov 25 15:13:46 ieu-dhcp1 dhcpd[23577]: DHCPDISCOVER from 00:07:32:xx:xx:xx via 10.xx.xx.1: unknown network segment<br>
<br>
?<br>
<br>
Background is, we (unfortunately) got new network hardware (Huawei instead of Cisco), and now I get also DHCP requests from buildings and networks that do not belong to our department and that are not served by our DHCP server. This is usually not a problem
since the server simply ignores those requests (though it logs them), but now there is a client in one of the other subnets which constantly sends DISCOVERS (about 200 per minute); they fill my log file and I’d like to get rid of them…
<br>
<br>
I tried to add the MAC address of the rogue client to the config file with an „ignore booting“ statement, but the DISCOVERs still get logged.<br>
<br>
<br>
Thanks, Tina<br>
<br>
<br>
<br>
<br>
-- <br>
ISC funds the development of this software with paid support subscriptions. Contact us at
<a href="https://www.isc.org/contact/">https://www.isc.org/contact/</a> for more information.<br>
<br>
dhcp-users mailing list<br>
dhcp-users@lists.isc.org<br>
<a href="https://lists.isc.org/mailman/listinfo/dhcp-users">https://lists.isc.org/mailman/listinfo/dhcp-users</a><br>
</div>
</span></font>
</body>
</html>