[Kea-users] NAK responses getting dropped
Darren Ankney
darren.ankney at gmail.com
Thu Oct 8 00:04:03 UTC 2026
Hello Norman,
> Not entirely sure what you mean by “full logs”
I was referring to sending the full logs to the list. I notice that
the log messages are being sent on a bond interface. Your
configuration just has * in the interfaces configuration so there
isn't much information there. What is the tcpdump command you are
running to capture traffic? Could you send the output of ip address
show? If you have public addresses there that you don't want to
expose, please redact them but if they are relevant to this problem
that might make it harder to help. I am wondering if Kea is sending
on an unexpected interface or if perhaps your capture isn't capturing
all of the bond interface. It could be that Kea isn't sending the
packet perhaps, but that seems the least likely scenario so far.
If you don't want to send logs here, have a look at
"kea-dhcp4.packets" on debug 99. If you have a pattern defined, you
might consider adding another output section so that you also write to
a file. The reason being, Kea will print most of the detail of the
packet to the logs and that might offer some clue since you are not
seeing the packet in your capture. Something like this would do:
"loggers": [
{
"name": "kea-dhcp4.packets",
"output-options": [
{
# ... your current output options are here
},
{
"output": "kea-dhcp4-packets.log",
}
],
"severity": "DEBUG",
"debuglevel": 99
}
]
The above should produce rather detailed output in
kea-dhcp4-packets.log which should be at the default logging location
(if using our packages, that is probably /var/log/kea/).
Thank you,
Darren Ankney
On Tue, Oct 6, 2026 at 8:32 AM Elton, Norman N <wnelto at wm.edu> wrote:
>
> Good morning!
>
> I’m running the packet capture on the server itself. Not entirely sure what you mean by “full logs”. I cranked the level up to DEBUG for all loggers and did not see any additional messages related to these transactions. Happy to do more digging.
>
> I’ll paste a trimmed-down version of our configuration below. I removed all the unrelated subnets.
>
> Thanks!!
>
> Norman
>
>
> {
> "Dhcp4": {
> "valid-lifetime": 86400,
> "interfaces-config": {
> "interfaces": [
> "*"
> ],
> "dhcp-socket-type": "udp"
> },
> "decline-probation-period": 3600,
> "lease-database": {
> "type": "memfile",
> "persist": true,
> "lfc-interval": 86400,
> "name": "/var/lib/kea/kea-leases4.csv"
> },
> "hosts-database": {
> "type": "mysql",
> "name": "kea",
> "user": "kea",
> "password": "..."
> },
> "shared-networks": [
> ...
> ],
> "subnet4": [
> {
> "user-context": {
> "name": "STUDENT-TUCKER",
> "regions": "student"
> },
> "subnet": "100.70.0.0/16",
> "valid-lifetime": 86400,
> "pools": [
> {
> "pool": "100.70.0.50 - 100.70.99.255",
> "client-class": "HA_KEA_01"
> },
> {
> "pool": "100.70.100.0 - 100.70.199.255",
> "client-class": "HA_KEA_02"
> },
> {
> "pool": "100.70.235.0 - 100.70.244.255",
> "client-class": "HA_KEA_01"
> },
> {
> "pool": "100.70.245.0 - 100.70.254.255",
> "client-class": "HA_KEA_02"
> }
> ],
> "option-data": [
> {
> "name": "routers",
> "data": "100.70.0.1"
> }
> ],
> "id": 1682309120
> }
> ],
> "echo-client-id": false,
> "sanity-checks": {
> "lease-checks": "fix"
> },
> "client-classes": [
> {
> "name": "INOVA_CLOCK",
> "test": "hexstring(substring(pkt4.mac, 0, 3), ':') == '00:60:35'",
> "option-data": [
> {
> "name": "CLOCK-INFO",
> "data": "timeserver=time.example.org;timezone=-5;dst=-1 8 2 2 1 1 10 2"
> }
> ]
> },
> {
> "name": "JUNIPER",
> "test": "substring(option[60].text, 0, 7) == 'Juniper'",
> "option-data": [
> {
> "name": "EZ_PROVISIONING_CONFIG_FILE_NAME",
> "space": "EZ_PROVISIONING_SPACE",
> "data": "..."
> },
> {
> "name": "EZ_PROVISIONING_IMAGE_TRANSFER_MODE",
> "space": "EZ_PROVISIONING_SPACE",
> "data": "http"
> },
> {
> "name": "vendor-encapsulated-options",
> "always-send": true
> }
> ]
> },
> {
> "name": "AUDIOCODES_405",
> "test": "option[60].hex == '405HD' or option[77].hex == '405HD'",
> "option-data": [
> {
> "name": "AUDIOCODES-PROVISIONING",
> "data": "...",
> "always-send": true
> }
> ]
> }
> ],
> "option-def": [
> {
> "name": "CLOCK-INFO",
> "code": 230,
> "type": "string"
> },
> {
> "name": "AUDIOCODES-PROVISIONING",
> "code": 160,
> "type": "string"
> },
> {
> "name": "EZ_PROVISIONING",
> "type": "empty",
> "code": 43,
> "encapsulate": "EZ_PROVISIONING_SPACE"
> },
> {
> "name": "EZ_PROVISIONING_CONFIG_FILE_NAME",
> "code": 1,
> "space": "EZ_PROVISIONING_SPACE",
> "type": "string"
> },
> {
> "name": "EZ_PROVISIONING_IMAGE_TRANSFER_MODE",
> "code": 3,
> "space": "EZ_PROVISIONING_SPACE",
> "type": "string"
> },
> {
> "name": "EZ_PROVISIONING_SERVER",
> "code": 150,
> "type": "ipv4-address"
> }
> ],
> "option-data": [
> {
> "name": "domain-name-servers",
> "data": "192.168.29.9, 192.168.20.9",
> "always-send": true
> },
> {
> "name": "domain-name",
> "data": "example.org"
> }
> ],
> "match-client-id": false,
> "host-reservation-identifiers": [
> "hw-address"
> ],
> "reservations-global": false,
> "reservations-in-subnet": false,
> "reservations-out-of-pool": true,
> "authoritative": true,
> "loggers": [
> {
> "name": "kea-dhcp4",
> "output_options": [
> {
> "output": "syslog",
> "flush": false
> }
> ],
> "severity": "INFO"
> }
> ],
> "multi-threading": {
> "enable-multi-threading": true,
> "thread-pool-size": 4,
> "packet-queue-size": 28
> },
> "control-socket": {
> "socket-type": "unix",
> "socket-name": "/var/run/kea/control-socket"
> },
> "hooks-libraries": [
> {
> "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_mysql_cb.so",
> "parameters": {}
> },
> {
> "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_lease_cmds.so",
> "parameters": {}
> },
> {
> "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_stat_cmds.so",
> "parameters": {}
> },
> {
> "library": "/usr/lib/x86_64-linux-gnu/kea/hooks/libdhcp_ha.so",
> "parameters": {
> "high-availability": [
> {
> "this-server-name": "KEA_01",
> "mode": "load-balancing",
> "heartbeat-delay": 10000,
> "max-response-delay": 60000,
> "max-ack-delay": 5000,
> "max-unacked-clients": 5,
> "max-rejected-lease-updates": 10,
> "delayed-updates-limit": 100,
> "peers": [
> {
> "name": "KEA_01",
> "url": "http://192.168.10.154:3000",
> "role": "primary",
> "auto-failover": true
> },
> {
> "name": "KEA_02",
> "url": "http://192.168.10.155:3000",
> "role": "secondary",
> "auto-failover": true
> }
> ]
> }
> ]
> }
> }
> ]
> }
> }
>
>
>
>
> >> HI Norman,
>
> >> Where are you capturing the packets? Directly on the Kea server or
> >> somewhere else? Also, full logs and your Kea configuration would be
> >> necessary to get a clearer picture of what might be happening.
>
> >> Thank you,
> >> Darren Ankney
>
> From: Elton, Norman N <wnelto at wm.edu>
> Date: Friday, October 2, 2026 at 10:52 AM
> To: Kea user's list <kea-users at lists.isc.org>
> Subject: NAK responses getting dropped
>
> We have clients requesting addresses in the wrong subnet, which Kea is trying to send a NAK:
>
> [kea-dhcp4.dhcp4.123] DHCP4_QUERY_LABEL received query: [hwtype=1 bc:9f:58:1b:cf:f3], cid=[01:bc:9f:58:1b:cf:f3], tid=0x6a744f8
> [kea-dhcp4.packets.123] DHCP4_PACKET_RECEIVED [hwtype=1 bc:9f:58:1b:cf:f3], cid=[01:bc:9f:58:1b:cf:f3], tid=0x6a744f8: DHCPREQUEST (type 3) received from 100.70.0.2 to 128.239.10.154 on interface bond0.10
> [kea-dhcp4.leases.123] DHCP4_INIT_REBOOT [hwtype=1 bc:9f:58:1b:cf:f3], cid=[01:bc:9f:58:1b:cf:f3], tid=0x6a744f8: client is in INIT-REBOOT state and requests address 100.69.0.173
> [kea-dhcp4.packets.123] DHCP4_PACKET_SEND [hwtype=1 bc:9f:58:1b:cf:f3], cid=[no info], tid=0x6a744f8: trying to send packet DHCPNAK (type 6) from 128.239.10.154:67 to 100.70.0.2:67 on interface bond0.10
>
> Problem is, the NAK is not being sent. When running packet captures, I see tons ACKs but no NAKs. The pkt4-nak-sent statistic is increasing. Just … no packets on the wire.
>
> I cranked up kea-dhcp4.packets to DEBUG mode, no additional information.
>
> Kea 2.6.4 running in load-balancing high availability mode.
>
> Any suggestions?
>
> Thanks,
>
> Norman Elton
> --
> ISC funds the development of this software with paid support subscriptions. Contact us at https://www.isc.org/contact/ for more information.
>
> To unsubscribe visit https://lists.isc.org/mailman/listinfo/kea-users.
> Kea-users at lists.isc.org
More information about the Kea-users
mailing list