Jump to content

DHCPREQUEST on wlan2 (lots)


i8igmac

Recommended Posts

wlan2 ->192.168.97.1

eth0 -> 192.168.96.1

(dnsmasq.conf)

interface=eth0
dhcp-range=192.168.96.50,192.168.96.150,12h
interface=wlan2
dhcp-range=192.168.97.50,192.168.97.150,12h

so, if a device connects over eth0 or wlan2, dnsmasq will do a fantastic job...

i have a machine struggling to connect and keeps attempting a dhcp request...

May  7 08:17:04 kali dhclient: DHCPREQUEST on wlan2 to 255.255.255.255 port 67

clients that connect to wlan2 should get a new ip on the 192.168.97.subnet.

im not sure what machine continues to flood dhcprequest...

here is a network packet, i dumped with this command

tcpick -yH -C -i wlan2 "port 67"

01 01 06 00 f1 13 af 3f ff ff 00 00 0a 00 00 05 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 ca 81 ee 5c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 63 82 53 63 35 01 03 0c 06 69 70 68 6f 6e 65 37 0d 01 1c 02 03 0f 06 77 0c 2c 2f 1a 79 2a ff 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

01 01 06 00 f1 13 af 3f ff ff

ill read about this packet and find the source and destination ip. witch might be this first string...

Edited by i8igmac
Link to comment
Share on other sites

Employ a notification system: hard-block all MAC addresses that start with AF:A3:3F on the router and wait for the owner of the affected machine to come ask you why their internet is broken.

Link to comment
Share on other sites

  • 2 weeks later...
On 5/11/2016 at 2:21 AM, cooper said:

Employ a notification system: hard-block all MAC addresses that start with AF:A3:3F on the router and wait for the owner of the affected machine to come ask you why their internet is broken.

Lol, I dub it the "smoke 'em out" method

Link to comment
Share on other sites

In dutch it's called "een piep-systeem" - a beeping-system. In dutch, when you say someone 'starts to beep' ("begint te piepen") it has a slang meaning of someone being childish and/or making noise about being sorry for themselves. The use of that phrase is usually reserved for kids who are being annoying because they want something they cannot have (candy/toy/their way/whatever). In this case, it's beautifully suitable to both viewpoints to the situation - an alarm going off because something has gone awry vs someone being prissy because they discovered you made it impossible for them to have their way.

Link to comment
Share on other sites

Join the conversation

You can post now and register later. If you have an account, sign in now to post with your account.

Guest
Reply to this topic...

×   Pasted as rich text.   Paste as plain text instead

  Only 75 emoji are allowed.

×   Your link has been automatically embedded.   Display as a link instead

×   Your previous content has been restored.   Clear editor

×   You cannot paste images directly. Upload or insert images from URL.

  • Recently Browsing   0 members

    • No registered users viewing this page.
×
×
  • Create New...