[Dnsmasq-discuss] Should every allocated (by DHCP) address be in /var/lib/misc/dnsmasq.leases?

Chris Green cl at isbd.net
Wed Jan 11 16:18:45 GMT 2017


On Wed, Jan 11, 2017 at 04:54:33PM +0100, Albert ARIBAUD wrote:
> Hi Chris,
> 
> Le Wed, 11 Jan 2017 15:09:54 +0000
> Chris Green <cl at isbd.net> a écrit:
> 
> > I have a mystery IP on my LAN which looks as if it has been allocated
> > by my dnsmasq process but it isn't in /var/lib/misc/dnsmasq.leases.
> > 
> > Is there anywhere else that I could look to see how/when dnsmasq
> > allocated an IP?
> >
> > This is a small home LAN running on 192.168.1.xxx subnet with dnsmasq
> > running on a raspberrypi.
> 
> If your dnsmasq's config has --log-dhcp, then you should find IP
> allocations mentioned in your syslog (or whatever is systemd's
> equivalent if applicable).
> 
No, I don't have --log-dhcp set, however there are some records in
syslog like:-

Jan 11 07:28:25 pi dnsmasq-dhcp[2094]: DHCPREQUEST(eth0) 192.168.1.101 40:61:86:98:f2:41 
Jan 11 07:28:25 pi dnsmasq-dhcp[2094]: DHCPACK(eth0) 192.168.1.101 40:61:86:98:f2:41 backup

However there's not the mystery one there.


> Otherwise yes, /var/lib/misc/dnsmasq.leases contains all leases
> currently in use (IIRC, when a client properly drops the lease, it is
> removed from the file).
> 
> Now, just because there is an IP on your network which is within your
> dnsmasq's DHCP range does not mean it has been allocated by it. It
> could just as well be that some host decided to use this IP on your
> network.
> 
Yes, I realise that.  However the allocated IP (192.168.1.91) doesn't
seem a very likely one for a system to 'guess' by itself.  Also I
'should' know about all the systems on my LAN and they either use DHCP
(and thus dnsmasq) or have fixed IP (which dnsmasq gets from
/etc/hosts on the raspberry pi).

I guess 192.168.1.91 may have been allocated a long time ago (by
dnsmasq).

It's just a bit worrying because 192.168.1.91 doesn't respond to ping
or any attempt to connect to it.  The only things that show it up are
nmap and arp-scan.

- 
Chris Green



More information about the Dnsmasq-discuss mailing list