Sunday, November 1, 2020

Clients all of a sudden requesting out-of-range IPs

I run a fairly simple network for my cohousing community with 34 homes. I am by no means a networking expert. We have a Comcast business account shared via a Netgate pfSense box and several unmanaged switches. Things generally work fine and don't need babysitting. The last few days, though, I've had random residents telling me that they're losing connectivity.

Today I dug into the logs and I see that several, seemingly random, clients - which are all individual residents' home routers - are requesting IP addresses outside of our range. We've used the same IP range on our internal network for 17 years and I haven't changed anything on the pfSense box since the last time I upgraded it to the latest release a few months ago. An example of what I'm seeing in the DHCP logs:

Nov 1 20:20:20 dhcpd DHCPOFFER on 10.20.60.154 to 42:c1:6d:64:87:ae (my-router) via igb1 Nov 1 20:20:19 dhcpd DHCPNAK on 10.0.0.3 to 42:c1:6d:64:87:ae via igb1 Nov 1 20:20:19 dhcpd DHCPREQUEST for 10.0.0.3 (10.0.0.1) from 42:c1:6d:64:87:ae via igb1: wrong network. Nov 1 20:20:19 dhcpd DHCPDISCOVER from 42:c1:6d:64:87:ae (my-router) via igb1 

I count 57 of these exchanges in the last 24 hours, but only three people notified me that they had no connectivity. It seems that most of these resolve as they should, with the client accepting the offer, but sometimes they don't accept and sometimes they keep making the same request over and over, but eventually stop. I've seen the same client request different IPs in the 10.0.0.x range.

My first thought was that there was a rogue DHCP server on the network. This happened once before when a resident connected their router incorrectly. However, I get request timed out when I try to ping 10.0.0.0, 10.0.0.1 or 10.0.0.x. Is it safe to assume that a client would only request an IP address that it had previously been assigned, and so something must have assigned these 10.0.0.x IPs at some point?

I have been seeing another sporadic issue for the past few months that could be related, but it's a bit beyond my knowledge. We have occasionally lost internet connectivity. A reboot seems to fix it, but I see A LOT of this in the routing logs:

 Nov 1 18:38:49 radvd 82799 sendmsg: No buffer space available 

I've been trying to research in my spare time, but haven't found a solution yet. When it first happened a few months ago, Comcast came out and replaced the splitter (for internet & TV) in front of their modem and it seemed ok for a few weeks.



No comments:

Post a Comment