Skip to content

Instantly share code, notes, and snippets.

@n1koo

n1koo/tcpdump of dhcp reply on broadcast

Last active April 4, 2025 08:07
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save n1koo/39158b3c935c5fb1e604ce3ccad9ef5f to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save n1koo/39158b3c935c5fb1e604ce3ccad9ef5f to your computer and use it in GitHub Desktop.
Download ZIP
DHCP logs (no responses to renew, always lease lost)
Raw
gistfile1.txt
2025-04-03T10:11:01+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: started, v1.34.1. (interface:eth9)
2025-04-03T10:11:02+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: broadcasting discover (interface:eth9)
2025-04-03T10:11:03+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: received offer of 85.253.200.51 (interface:eth9)
2025-04-03T10:11:03+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending request (interface:eth9)
2025-04-03T10:11:03+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: received ACK: lease of 85.253.200.51 obtained from 85.253.0.13, lease time 7200 (interface:eth9)
2025-04-03T11:11:03+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T11:41:05+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T11:56:05+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T12:03:35+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T12:07:20+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T12:09:13+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T12:10:09+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T12:10:37+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T12:10:40+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: broadcasting renew (interface:eth9)
2025-04-03T12:10:44+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: broadcasting renew (interface:eth9)
2025-04-03T12:10:48+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: broadcasting renew (interface:eth9)
2025-04-03T12:10:53+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: lease lost, entering init state (interface:eth9)
2025-04-03T12:10:53+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: broadcasting discover (interface:eth9)
2025-04-03T12:10:53+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: received offer of 62.65.213.198 (interface:eth9)
2025-04-03T12:10:53+03:00 Foobar ubios-udapi-server[1373229]: [info ] ubios-dhcpc-decline-script: DHCP offer 62.65.213.198/22 on interface eth9, gateway: 62.65.212.1
2025-04-03T12:10:54+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending request (interface:eth9)
2025-04-03T12:10:57+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending request (interface:eth9)
2025-04-03T12:10:57+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: received ACK: lease of 62.65.213.198 obtained from 85.253.0.13, lease time 7200 (interface:eth9)
-----
2025-04-03T13:10:57+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T13:40:58+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T13:55:59+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T14:03:29+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T14:07:14+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T14:09:07+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T14:10:03+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T14:10:31+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T14:09:07+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T14:10:03+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T14:10:31+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending renew to server 85.253.0.13 (interface:eth9)
2025-04-03T14:10:34+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: broadcasting renew (interface:eth9)
2025-04-03T14:10:42+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: broadcasting renew (interface:eth9)
2025-04-03T14:10:46+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: broadcasting renew (interface:eth9)
2025-04-03T14:10:50+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: lease lost, entering init state (interface:eth9)
2025-04-03T14:10:50+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: broadcasting discover (interface:eth9)
2025-04-03T14:10:50+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: received offer of 62.65.213.155 (interface:eth9)
2025-04-03T14:10:50+03:00 Foobar ubios-udapi-server[1485589]: [info ] ubios-dhcpc-decline-script: DHCP offer 62.65.213.155/22 on interface eth9, gateway: 62.65.212.1
2025-04-03T14:10:51+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending request (interface:eth9)
2025-04-03T14:10:54+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: sending request (interface:eth9)
2025-04-03T14:10:54+03:00 Foobar ubios-udapi-server[1229233]: udhcpc: received ACK: lease of 62.65.213.155 obtained from 85.253.0.13, lease time 7200 (interface:eth9)
Raw
tcpdump of dhcp reply on broadcast
10:06:07.372762 IP (tos 0xc0, ttl 64, id 41413, offset 0, flags [none], proto UDP (17), length 338)
85.253.200.3.67 > 85.253.200.190.68: BOOTP/DHCP, Reply, length 310, xid 0x3e74b353, Flags [none]
Your-IP 85.253.200.190
Server-IP 85.253.0.13
Gateway-IP 94.246.216.1
Client-Ethernet-Address e0:63:da:57:cd:f0
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: ACK
Subnet-Mask (1), length 4: 255.255.254.0
Default-Gateway (3), length 4: 85.253.200.1
BR (28), length 4: 85.253.201.255
Domain-Name (15), length 10: "starman.ee"
Lease-Time (51), length 4: 7200
Server-ID (54), length 4: 85.253.0.13
RN (58), length 4: 3600
RB (59), length 4: 6300
Domain-Name-Server (6), length 8: 85.253.0.130,85.253.0.2
Raw
tcpdump of dhcp request on broadcast
10:06:07.354714 IP (tos 0x0, ttl 64, id 0, offset 0, flags [none], proto UDP (17), length 340)
0.0.0.0.68 > 255.255.255.255.67: BOOTP/DHCP, Request from e0:63:da:57:cd:f0, length 312, xid 0x3e74b353, Flags [none]
Client-Ethernet-Address e0:63:da:57:cd:f0
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: Request
Requested-IP (50), length 4: 85.253.200.190
Server-ID (54), length 4: 85.253.0.13
MSZ (57), length 2: 576
Parameter-Request (55), length 7:
Subnet-Mask (1), Default-Gateway (3), Domain-Name-Server (6), Hostname (12)
Domain-Name (15), BR (28), NTP (42)
Vendor-Class (60), length 32: "Ubiquiti UniFi Dream Machine Pro"
Client-ID (61), length 7: ether e0:63:da:57:cd:f0
Raw
tcpdump of unicast request (that gets no response)
20:36:22.284160 IP (tos 0x0, ttl 64, id 32416, offset 0, flags [DF], proto UDP (17), length 328)
94.246.245.172.68 > 85.253.0.13.67: BOOTP/DHCP, Request from e0:63:da:57:cd:f0, length 300, xid 0x4cd44138, Flags [none]
Client-IP 94.246.245.172
Client-Ethernet-Address e0:63:da:57:cd:f0
Vendor-rfc1048 Extensions
Magic Cookie 0x63825363
DHCP-Message (53), length 1: Request
MSZ (57), length 2: 576
Parameter-Request (55), length 7:
Subnet-Mask (1), Default-Gateway (3), Domain-Name-Server (6), Hostname (12)
Domain-Name (15), BR (28), NTP (42)
Vendor-Class (60), length 32: "Ubiquiti UniFi Dream Machine Pro"
Client-ID (61), length 7: ether e0:63:da:57:cd:f0
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment