[Dnsmasq-discuss] Bug-ette Android requesting excessive leases

[Albert ARIBAUD]

Hi Ed,

Le Fri, 23 Oct 2015 17:55:06 +0100, Ed W <lists at wildgooses.com> a
écrit :

> Hi
> 
> I notice an anomaly with my OnePlus Android phones.  They have been 
> acquiring additional leases for no good reason.  Here is a dump from a 
> little app I have which monitors ARP and dhcp lease allocations:
> 
> 192.168.105.103/c0:ee:fb:34:64:18 - OnePlus Tech (Shenzhen) Ltd - 
> android-a837a8c17ea54bc3 - leased until: 2015-10-26T16:34:12 - seen: 
> 2015-10-23T16:39:00
> 192.168.105.105/c0:ee:fb:34:64:18 - OnePlus Tech (Shenzhen) Ltd - leased 
> until: 2015-10-24T14:31:08
> 192.168.105.106/c0:ee:fb:34:64:18 - OnePlus Tech (Shenzhen) Ltd - leased 
> until: 2015-10-25T16:05:49
> 192.168.105.115/c0:ee:fb:42:63:b1 - OnePlus Tech (Shenzhen) Ltd - leased 
> until: 2015-10-24T14:28:00
> 192.168.105.116/c0:ee:fb:42:63:b1 - OnePlus Tech (Shenzhen) Ltd - leased 
> until: 2015-10-24T15:34:39
> 192.168.105.117/c0:ee:fb:42:63:b1 - OnePlus Tech (Shenzhen) Ltd - leased 
> until: 2015-10-25T12:16:12
> 192.168.105.118/c0:ee:fb:42:63:b1 - OnePlus Tech (Shenzhen) Ltd - 
> android-9fe15ff2e8e65398 - leased until: 2015-10-26T15:45:48 - seen: 
> 2015-10-23T16:39:00
> 
> DNSMasq 2.75, operating on a bridge br0 of two devices wlan/lan.
> 
> What you can see here are my two OnePlus devices have apparently 
> acquired additional leases for no obvious reason. The "seen" shows that 
> my arp-ping isn't seeing any answer on the other lease addresses, so we 
> can be sure it's not a genuine case of multiple IPs per MAC
> 
> The relevant config is
>      dhcp-range=192.168.105.50,192.168.105.150,72h
>      dhcp-authoritative
> 
> Unfortunately I don't have the logs for the allocations (it's on a small 
> router which logs to memory only).
> 
> However, my best guess on what happened is that on lease renewal the 
> Android device is answering dnsmasq's ping (to check if the IP is free)?
> 
> If this is interesting/plausible I can try cranking down my lease times 
> and record the logs to see if I can catch it in action?

Problem is, we don't see what IP is requested, nor do we see which DHCP
requests or replies are sent.

Can you ssh to your server from your desktop machine? If yes, then you
should do so, then through this shell, kill the background dnsmasq and
launch it in the foreground (with -d, and -q --log-dhcp too). Make sure
you log your ssh session.

This way, we would have a much more detailed log without straining your
router's logging capabilities.

> Thanks
> 
> Ed W

Amicalement,
-- 
Albert.