<div dir="ltr">Hey Simon,<br><br>In my previous email, "Healthy Node" and "Failed Node" are two entirely different servers, completely independent in each other (which explains why they have different IP addresses). <div><br></div><div>Sorry - I should have made that clearer! Just wanted to illustrate the difference in output between a known working server and a failed server. Your thought process did spark my interest in DHCP logs; however, the IP address has been consistent throughout the issues.<br><br>Thanks,<br>Zach</div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Feb 6, 2018 at 1:35 PM, Simon Kelley <span dir="ltr"><<a href="mailto:simon@thekelleys.org.uk" target="_blank">simon@thekelleys.org.uk</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span class="">On 05/02/18 15:43, Zi Dvbelju wrote:<br>
<br>
</span><span class="">> Healthy Node (netstat)<br>
> ```<br>
> *udp        0      0 <a href="http://127.0.0.1:53" rel="noreferrer" target="_blank">127.0.0.1:53</a> <<a href="http://127.0.0.1:53" rel="noreferrer" target="_blank">http://127.0.0.1:53</a>>           <br>
> 0.0.0.0:*                           1400/dnsmasq*<br>
> *udp        0      0 <a href="http://10.3.1.79:53" rel="noreferrer" target="_blank">10.3.1.79:53</a> <<a href="http://10.3.1.79:53" rel="noreferrer" target="_blank">http://10.3.1.79:53</a>>           <br>
> 0.0.0.0:*                           1400/dnsmasq*<br>
> *udp        0      0 <a href="http://172.17.0.1:53" rel="noreferrer" target="_blank">172.17.0.1:53</a> <<a href="http://172.17.0.1:53" rel="noreferrer" target="_blank">http://172.17.0.1:53</a>>         <br>
>  0.0.0.0:*                           1400/dnsmasq*<br>
<br>
</span><span class="">> /var/log/syslog.7:2018-02-<wbr>05T06:05:31.066648+00:00 dnsmasq[1359]: failed<br>
</span>> to create listening socket for 172.17.0.1 <<a href="http://172.17.0.1" rel="noreferrer" target="_blank">http://172.17.0.1</a>>: Address<br>
<span class="">> already in use<br>
> /var/log/syslog.7:2018-02-<wbr>05T06:05:31.066813+00:00 dnsmasq[1359]: failed<br>
</span>> to create listening socket for 10.3.4.228 <<a href="http://10.3.4.228" rel="noreferrer" target="_blank">http://10.3.4.228</a>>: Address<br>
<span class="">> already in use<br>
> /var/log/syslog.7:2018-02-<wbr>05T06:05:31.066917+00:00 dnsmasq[1359]: failed<br>
</span><span class="">> to create listening socket for 127.0.0.1 <<a href="http://127.0.0.1" rel="noreferrer" target="_blank">http://127.0.0.1</a>>: Address<br>
> already in use<br>
> ```<br>
><br>
<br>
</span>Further to my previous question, I can see that the dnsmasq _was_<br>
listening in  127.0.0.1, 172.17.0.1 and 10.3.1.79, and then it attempts<br>
to listen on  127.0.0.1, 172.17.0.1 and 10.3.4.228, so that implies a<br>
network configuration change, with something changing 10.3.1.79 -><br>
10.3.4.228. Any idea what that's about? If you can find what causes that<br>
change, we might, at very least, have a way to reproduce this at will.<br>
<br>
<br>
<br>
Cheers,<br>
<br>
Simon.<br>
<br>
</blockquote></div><br></div>