0

I am new to the DHCP world. I have a device with DHCP client which does not acquired IP address some times. When I started analyzing the DHCP frames through Wireshark I get following two types of frames.

Frame A is the situation when DHCPREQUEST gets ACK from server. While in Frame B, it is not getting any response.

[FRAME--A]

No.     Time           Source                Destination           Protocol Length Info
   2093 319.751000000  0.0.0.0               255.255.255.255       DHCP     342    DHCP Request  - Transaction ID 0x3239d4b2

Frame 2093: 342 bytes on wire (2736 bits), 342 bytes captured (2736 bits) Ethernet II, Src: Industri_00:b6:04 (00:0b:d8:00:b6:04), Dst: Broadcast (ff:ff:ff:ff:ff:ff) Internet Protocol Version 4, Src: 0.0.0.0 (0.0.0.0), Dst: 255.255.255.255 (255.255.255.255) User Datagram Protocol, Src Port: bootpc (68), Dst Port: bootps (67) Bootstrap Protocol
    Message type: Boot Request (1)
    Hardware type: Ethernet (0x01)
    Hardware address length: 6
    Hops: 0
    Transaction ID: 0x3239d4b2
    Seconds elapsed: 0
    Bootp flags: 0x0000 (Unicast)
    Client IP address: 0.0.0.0 (0.0.0.0)
    Your (client) IP address: 0.0.0.0 (0.0.0.0)
    Next server IP address: 0.0.0.0 (0.0.0.0)
    Relay agent IP address: 0.0.0.0 (0.0.0.0)
    Client MAC address: Industri_00:b6:04 (00:0b:d8:00:b6:04)
    Client hardware address padding: 00000000000000000000
    Server host name not given
    Boot file name not given
    Magic cookie: DHCP
    Option: (53) DHCP Message Type
        Length: 1
        DHCP: Request (3)
    Option: (50) Requested IP Address
        Length: 4
        Requested IP Address: 172.16.220.155 (172.16.220.155)
    Option: (61) Client identifier
        Length: 7
        Hardware type: Ethernet (0x01)
        Client MAC address: Industri_00:b6:04 (00:0b:d8:00:b6:04)
    Option: (55) Parameter Request List
        Length: 7
        Parameter Request List Item: (1) Subnet Mask
        Parameter Request List Item: (3) Router
        Parameter Request List Item: (6) Domain Name Server
        Parameter Request List Item: (15) Domain Name
        Parameter Request List Item: (44) NetBIOS over TCP/IP Name Server
        Parameter Request List Item: (46) NetBIOS over TCP/IP Node Type
        Parameter Request List Item: (47) NetBIOS over TCP/IP Scope
    Option: (255) End
        Option End: 255
    Padding

[FRAME--B]

No.     Time           Source                Destination           Protocol Length Info
    135 20.969000000   0.0.0.0               255.255.255.255       DHCP     342    DHCP Request  - Transaction ID 0xcc160e02

Frame 135: 342 bytes on wire (2736 bits), 342 bytes captured (2736 bits) Ethernet II, Src: Industri_00:b6:04 (00:0b:d8:00:b6:04), Dst: Broadcast (ff:ff:ff:ff:ff:ff)
    Destination: Broadcast (ff:ff:ff:ff:ff:ff)
    Source: Industri_00:b6:04 (00:0b:d8:00:b6:04)
    Type: IP (0x0800)
Internet Protocol Version 4, Src: 0.0.0.0 (0.0.0.0), Dst: 255.255.255.255 (255.255.255.255) User Datagram Protocol, Src Port: bootpc (68), Dst Port: bootps (67) Bootstrap Protocol
    Message type: Boot Request (1)
    Hardware type: Ethernet (0x01)
    Hardware address length: 6
    Hops: 0
    Transaction ID: 0xcc160e02
    Seconds elapsed: 0
    Bootp flags: 0x0000 (Unicast)
    Client IP address: 172.16.220.155 (172.16.220.155)
    Your (client) IP address: 0.0.0.0 (0.0.0.0)
    Next server IP address: 0.0.0.0 (0.0.0.0)
    Relay agent IP address: 0.0.0.0 (0.0.0.0)
    Client MAC address: Industri_00:b6:04 (00:0b:d8:00:b6:04)
    Client hardware address padding: 00000000000000000000
    Server host name not given
    Boot file name not given
    Magic cookie: DHCP
    Option: (53) DHCP Message Type
        Length: 1
        DHCP: Request (3)
    Option: (61) Client identifier
        Length: 7
        Hardware type: Ethernet (0x01)
        Client MAC address: Industri_00:b6:04 (00:0b:d8:00:b6:04)
    Option: (55) Parameter Request List
        Length: 7
        Parameter Request List Item: (1) Subnet Mask
        Parameter Request List Item: (3) Router
        Parameter Request List Item: (6) Domain Name Server
        Parameter Request List Item: (15) Domain Name
        Parameter Request List Item: (44) NetBIOS over TCP/IP Name Server
        Parameter Request List Item: (46) NetBIOS over TCP/IP Node Type
        Parameter Request List Item: (47) NetBIOS over TCP/IP Scope
    Option: (255) End
        Option End: 255
    Padding

All I am trying to unplug and plug the network cable. Is the issue with DHCP client or it is server that is not configured correctly.

Can anyone please share some hints.

Improve this question
3
  • what does the network these devices are connected to look like? are there any switches or routers in between the server and client? Are you using VLANs on your network? Does the DHCP server give out addresses to any device? I am going to guess 172.16.220.155 is your assigned IP and your mac is 00:0b:d8:00:b6:04? It looks like you had been assigned an IP address at some point. Is this still the case or are you no longer being assigned an IP? Do you have access to the DHCP server handing out these addresses? is there any possibility all leases have been handed out on this network? – Richie086 Sep 11 '14 at 4:05
  • what does the network these devices are connected to look like?are there any switches or routers in between the server and client? Are you using VLANs on your network? Does the DHCP server give out addresses to any device? I do not know exactly. I am using an envoirnment already setup. I can get this information for IT support though. There are no switches though. Actually problem appears only if i use wall connector, and if i use to connect through switch it gets the ip every time. 172.16.220.155 is assigned ip that is correct. and mac is 00:0b:b6:04. It is an intermittent problem so yes – user367060 Sep 12 '14 at 13:14
  • it gets ip one time in many tries. I do not have access to dhcp server, but i can get information from IT department. These dhcp messages i have captured inside client device and if i use wireshark to monitor live dhcp traffic i see DHCP Request messages that are being broadcast. But when this problem occur, i don't see any dhcp packets on wireshark. It seem either client is not sending correct packets which are not being captured by Wireshark, or messages are not being physically sent out by PHY? What do you think Richie086. – user367060 Sep 12 '14 at 14:07
0

Your instincts are sound.

There's nothing that I can see here (though it's a little difficult to read outside of the wireshark interface) that would differentiate the two packets. Transaction ID and a few other fields that are supposed to vary are different, but that's it.

So you're client is fine. What about intermediate devices and/or the server?

IF the server is an actual server or some other device that can capture traffic, that's your next step. See what failure looks like from that end.

Improve this answer
1
  • Thanks for reply. From DHCP server which is an actual server, i got a log which shows messages like this. <br> Line 7167: 11,09/08/14,15:28:28,Renew,172.16.220.155,,000BD800B604, Line 7196: 11,09/08/14,15:31:08,Renew,172.16.220.155,,000BD800B604, Line 7202: 11,09/08/14,15:31:53,Renew,172.16.220.155,,000BD800B604, Line 7206: 11,09/08/14,15:31:54,Renew,172.16.220.155,,000BD800B604,</p> This shows packets are being received there but i am not sure how this message '11 (A lease was renewed by a client)' means. – user367060 Sep 10 '14 at 20:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.