<html><head></head><body><div style="color:#000; background-color:#fff; font-family:Helvetica Neue, Helvetica, Arial, Lucida Grande, sans-serif;font-size:16px"> <div id="yui_3_16_0_ym19_1_1537273439288_186655" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;">Hi all,</div><div id="yui_3_16_0_ym19_1_1537273439288_186656" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr"> I have been trying to replicate an issue of IP conflict on Open-WRT, the issue is randomly seen, and I expect in real life, it is related to a de-sync of the lease data base with the actual situation (in case a switch is between the client and the server and the server is rebooted e.g., so that the client acts as though it would have a fixed IP. Reported as seen as well when moving a client from one setup to another setup where the IP that it used to receive is used on the LAN).</div><div id="yui_3_16_0_ym19_1_1537273439288_186657" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr"><br id="yui_3_16_0_ym19_1_1537273439288_186658"></div><div id="yui_3_16_0_ym19_1_1537273439288_186659" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr"> I tested with 2 different versions of dnsmasq (2.78 and 2.79).</div><div id="yui_3_16_0_ym19_1_1537273439288_186660" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr"><br id="yui_3_16_0_ym19_1_1537273439288_186661"></div><div id="yui_3_16_0_ym19_1_1537273439288_186662" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr"> I use Scapy to forge DHCP Requests (see further).</div><div id="yui_3_16_0_ym19_1_1537273439288_186663" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr"><br id="yui_3_16_0_ym19_1_1537273439288_186664"></div><div id="yui_3_16_0_ym19_1_1537273439288_186665" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">Setup:</div><div id="yui_3_16_0_ym19_1_1537273439288_186666" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">I have a laptop with a fixed IP inside the range of the DHCP (192.168.1.0/26). I then forge a Request of that IP using scapy and I cannot explain the behavior:</div><div id="yui_3_16_0_ym19_1_1537273439288_186667" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">1. I see no ARP whatsoever to the requested IP when DNSMasq handles the request.</div><div id="yui_3_16_0_ym19_1_1537273439288_186668" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">2. When I request the fixed IP for a client with a random MAC, I instantly receive an ACK, then I see some unanswered ARP requests (*after*) as to "who has [IP just assigned]? Tell 192.168.1.1" where 192.168.1.1 is the DHCP server IP.</div><div id="yui_3_16_0_ym19_1_1537273439288_186669" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr"><br id="yui_3_16_0_ym19_1_1537273439288_186670"></div><div id="yui_3_16_0_ym19_1_1537273439288_186671" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">I end up in a situation where the dhcp.leases contains the fake MAC associated to the lease, while the ARP table contains the MAC of the fixed IP laptop (probably because I'm not sending any IP packet where the IP is associated to the fake MAC, so the switch cannot learn it).</div><div id="yui_3_16_0_ym19_1_1537273439288_186672" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr"><br id="yui_3_16_0_ym19_1_1537273439288_186673"></div><div id="yui_3_16_0_ym19_1_1537273439288_186674" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">I have observed that Windows 10 has a mechanism to prevent conflicts where, whenever a fixed IP is used/configured, after the link is up an ARP probe is sent with its own IP. In case it gets answered, the client keeps silent and start using a link local IPv4 (169....). Yet I have tested with a very old laptop running Windows 3.1 and I can replicate the issue.</div><div id="yui_3_16_0_ym19_1_1537273439288_186675" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">But basically, it is puzzling that the device is ARPing *after* the DHCP distributed the IP.<br id="yui_3_16_0_ym19_1_1537273439288_186676"><br id="yui_3_16_0_ym19_1_1537273439288_186677"></div><div id="yui_3_16_0_ym19_1_1537273439288_186678" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">*The all issue seems to boil down to:* why does DNSMasq not check if the IP is free before assigning it?<br id="yui_3_16_0_ym19_1_1537273439288_186679">I thought that unless option "-5" or "--no-ping" was set, DNSMasq would always ping once to the assigned IP *before* assignment (I controlled in the code and see that actually, there is a mechanism to store the positive identification as well as to blacklist IP's in case a client is constantly coming back).</div><div id="yui_3_16_0_ym19_1_1537273439288_186680" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">The only ARP I see in this case is *after* the IP is assigned. How come DNSMasq is not trying to ping before assignment? Is there an option to force this behavior (from the code I guess not)? Is DNSMasq also somehow relying on the ARP table and flags that are set on reachability? or solely on the _non_ answer to ping?</div><div id="yui_3_16_0_ym19_1_1537273439288_186681" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr"><br id="yui_3_16_0_ym19_1_1537273439288_186682"></div><div id="yui_3_16_0_ym19_1_1537273439288_186683" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">Thanks a lot for your assistance.</div><div id="yui_3_16_0_ym19_1_1537273439288_186684" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr"><br id="yui_3_16_0_ym19_1_1537273439288_186685"></div><div id="yui_3_16_0_ym19_1_1537273439288_186686" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">Regards,</div><div id="yui_3_16_0_ym19_1_1537273439288_186687" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">Bernard</div><div id="yui_3_16_0_ym19_1_1537273439288_186688" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr"><br id="yui_3_16_0_ym19_1_1537273439288_186689"></div><div id="yui_3_16_0_ym19_1_1537273439288_186690" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">Scapy forged packet (I know the source MAC does not match the client MAC, but I deem this good enough for testing, AFAIK it is a legal packet):</div><div id="yui_3_16_0_ym19_1_1537273439288_186691" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">dhcp_request = Ether(dst='ff:ff:ff:ff:ff:ff')/IP(src='0.0.0.0', dst='255.255.255.255')/UDP(dport=67, sport=68)/BOOTP(xid=RandInt())/DHCP(options=[('message-type', 'request'),("server_id","192.168.1.1"),("requested_addr","192.168.1.34"),("hostname","Scapy"), 'end'])</div><div id="yui_3_16_0_ym19_1_1537273439288_186692" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr"><br id="yui_3_16_0_ym19_1_1537273439288_186693"></div><div id="yiv7843324169yui_3_16_0_ym19_1_1537273439288_61907" style="background-color: transparent; color: rgb(0, 0, 0); font-family: Helvetica Neue,Helvetica,Arial,Lucida Grande,sans-serif; font-size: 16px; font-style: normal; font-variant: normal; font-weight: 400; letter-spacing: normal; orphans: 2; text-align: left; text-decoration: none; text-indent: 0px; text-transform: none; -webkit-text-stroke-width: 0px; white-space: normal; word-spacing: 0px;" dir="ltr">dhcp_ack = srp1(dhcp_request, iface='enp9s0')</div></div></body></html>