How to see what DHCP client does?

Question

• Does the dhcp client on Linux write any logs?
• If not, can logs be enabled and how?
• If it writes logs, where can they be found?
• How does a typical log of a dhcp client look like when obtaining IP and nameservers from a DHCP server?
• Where can I find the source code of the DHCP client?

In case there are relevant differences between Linuxes: I am interested in Debian 8.1 (default minimal installation amd64).

Answer 1

ISC's DHCP client is usually called dhclient in most Linux distributions. From man dhclient:

The client normally prints no output during its startup sequence. It can be made to emit verbose messages displaying the startup sequence events until it has acquired an address by supplying the -v command line argument. In either case, the client logs messages using the syslog(3) facility.

There are two possible ways to read your system log. On most systems that use systemd, you have to use journalctl, whereas cat /var/log/syslog is valid for systems that still employ a traditional init system.

Therefore, if your system is using systemd's logging facility, you can use journalctl | grep -Ei 'dhcp' to get DHCP client logs. Otherwise, enter cat /var/log/syslog | grep -Ei 'dhcp'.

Here is what my DHCP client log typically looks like:

Jul 20 14:17:39 trueclient1 NetworkManager[2622]: <info> (wlan1): canceled DHCP transaction, DHCP client pid 3325
Jul 20 14:17:42 trueclient1 NetworkManager[2622]: <info> Activation (wlan1) Beginning DHCPv4 transaction (timeout in 45 seconds)
Jul 20 14:17:42 trueclient1 dhclient: Internet Systems Consortium DHCP Client 4.2.2
Jul 20 14:17:42 trueclient1 dhclient: For info, please visit https://www.isc.org/software/dhcp/
Jul 20 14:17:42 trueclient1 NetworkManager[2622]: <info> (wlan1): DHCPv4 state changed nbi -> preinit
Jul 20 14:17:42 trueclient1 dhclient: DHCPREQUEST on wlan1 to 255.255.255.255 port 67
Jul 20 14:17:42 trueclient1 dhclient: DHCPACK from 10.8.8.1
Jul 20 14:17:42 trueclient1 NetworkManager[2622]: <info> (wlan1): DHCPv4 state changed preinit -> reboot

Answer 2

A hacky (but effective) way to debug dhclient on many Linux platforms is to enable bash tracing in /sbin/dhclient-script.

dhclient runs that script on most OS variants I've checked (RedHat, Debian, etc).

Simply adding -x to the shebang (first line) in that script should enable tracing each line to console, eg:

#!/bin/bash -x

Then you can run, for example

dhclient -r #release lease
dhclient #re-acquire lease

And you should see lots of output, not only from dhclient-script, but from all the included .d scripts in /etc/dhcp*.

The trace output should allow you to figure out what's happening and what decisions the code is making (reference the script itself when looking at the output).

You can usually deduce the inputs (eg parameters including IP, GATEWAY, etc) the script received from this output, but if not, you can temporarily add something like this to the script just before the exit:

   env | logger -t dhclient-debugging

Then check your log after running dhclient (/var/log/messages or /var/log/syslog)

Answer 3

As mentioned in this answer to a similar question, dhcpdump is useful to view dhcp packets in a readable format:

dhcpdump -i eth0

Example dump with redacted values:

---------------------------------------------------------------------------

  TIME: 2023-12-29 04:44:26.672
    IP: 1.2.3.4 (00:00:00:00:00:00d) > 1.2.3.4 (00:00:00:00:00:009)
    OP: 2 (BOOTPREPLY)
 HTYPE: 1 (Ethernet)
  HLEN: 6
  HOPS: 0
   XID: dd99df6c
  SECS: 1
 FLAGS: 0
CIADDR: 1.2.3.4
YIADDR: 1.2.3.4
SIADDR: 1.2.3.4
GIADDR: 1.2.3.4
CHADDR: 00:00:00:00:00:009:00:00:00:00:00:000:00:00:00:00
 SNAME: .
 FNAME: .
OPTION:  53 (  1) DHCP message type         5 (DHCPACK)
OPTION:  54 (  4) Server identifier         1.2.3.4
OPTION:  51 (  4) IP address leasetime      461 (7m41s)
OPTION:   1 (  4) Subnet mask               1.2.3.4
OPTION:   6 (  8) DNS server                1.2.3.4,1.2.3.4
OPTION:  15 (  6) Domainname                .local
OPTION:  28 (  4) Broadcast address         1.2.3.4
OPTION: 121 (  8) Classless Static Route    deadbeefdeadbeef ........
OPTION:   3 (  4) Routers                   1.2.3.4
OPTION: 249 (  8) MSFT - Classless route    deadbeefdeadbeef ........
---------------------------------------------------------------------------

Answer 4

Please find the answer inline.

• Does the dhcp client on Linux write any logs?

  
  Yes, it does.

• If not, can logs be enabled and how?

 1. Edit dhcpd.conf and add this line
  log-facility local7;

 2. Edit syslog.conf and append 
  local7.* /var/log/dhcpd.log

• If it writes logs, where can they be found?

  /var/log/dhcpd.log

• How does a typical log of a dhcp client look like when obtaining IP and nameservers from a DHCP server?

galaxy dhcpd: DHCPDISCOVER from 00:0d:62:d7:a0:12 via eth0
galaxy dhcpd: DHCPOFFER on 192.168.1.5 to 00:0d:62:d7:a0:12 via eth0
galaxy dhcpd: DHCPREQUEST for 192.168.1.5 (192.168.1.1) from 00:0d:62:d7:a0:12 via eth0
galaxy dhcpd: DHCPACK on 192.168.1.5 to 00:0d:62:d7:a0:12 via eth0

• Where can I find the source code of the DHCP client?

  
  Link 1
  Link 2