dhcp client not receiving offer from server

Discussion in 'Linux Networking' started by Henrik S. Hansen, Nov 18, 2004.

  1. A friend has a problem with getting a dhcp offer from the dhcp server.
    The problem occurs only when the eth0 hw (MAC) address is spoofed (with
    ifconfig hw ether ...). The spoofed hw address is valid and belongs to
    another of his NIC's. The reason he needs this is unimportant in this
    context (has to do with his ISP).

    We've troubleshooted this on my home LAN, where I have a dhcp server.
    The logs say that the server receive the discover, and the server
    responds. But for some reason, the client never responds to that
    offer. It works, however, if the mac address is not spoofed (ie. the
    original hw address). He uses dhclient, if that matters.

    Any ideas how to work this out are appreciated.
    Henrik S. Hansen, Nov 18, 2004
    1. Advertisements

  2. Henrik S. Hansen

    paul Guest

    Does it work if he spoofs another hw address that isn't also one
    of his NICs? Does it work if he changes the address of that
    other nic first? Have you checked the contents of the arp
    tables and/or flushed them?

    paul, Nov 18, 2004
    1. Advertisements

  3. No to both.
    Yes, no effect.

    It's strange, and we're running out of ideas.
    Henrik S. Hansen, Nov 18, 2004
  4. Henrik S. Hansen

    paul Guest

    What's the make and model of the NIC? Maybe MAC address changing doesn't
    work on it.

    paul, Nov 18, 2004
  5. It's a realtek 8139.
    Is that really possible? I thought that as long as you could change it
    via ifconfig, all is good?!
    Henrik S. Hansen, Nov 18, 2004
  6. Henrik S. Hansen

    paul Guest

    A quick google seems to show that it's unlikely that MAC address changing
    should fail. There's a program mentioned here: http://www.scyld.com/rtl8139.html
    rtl-diag that can be used to change the MAC address on the EEPROM (though it
    might need a patch to do so). Can't resolve the ftp server here though.

    paul, Nov 18, 2004
  7. Yeah, that shouldn't be the problem. I've spoofed mac addresses on
    realtek 8139 cards before.

    It's strange, though.
    Henrik S. Hansen, Nov 18, 2004
  8. Henrik S. Hansen

    AA Guest

    I would bring up a second laptop and sniff out the traffic with
    ethereal. That way you can see exactly what MACs are being seen.
    Another thing you can do to help narrow if it is software or hardware is
    boot from a bootable CD like knoppix and try it there.
    AA, Nov 18, 2004
  9. We'll try that. Thanks for the help, both of you.
    Henrik S. Hansen, Nov 19, 2004
    1. Advertisements

Ask a Question

Want to reply to this thread or ask your own question?

You'll need to choose a username for the site, which only take a couple of moments (here). After that, you can post your question and our members will help you out.