Weird MAC in DHCP request

From: Kenneth Wygand (KWygand@customonline.com)
Date: Fri Jul 02 2004 - 14:13:54 GMT-3


R7(e0/0)----------(e0/0)R8
 
R8 is requesting an address through DHCP from R7. The followind debug output is observed on R7:
 
<SNIP>
00:03:32: DHCPD: DHCPDISCOVER received from client 0063.6973.636f.2d30.3030.352e
.3565.3663.2e63.3065.302d.4574.302f.30 on interface Ethernet0/0.
00:03:34: DHCPD: assigned IP address 78.78.78.2 to client 0063.6973.636f.2d30.30
30.352e.3565.3663.2e63.3065.302d.4574.302f.30.
00:03:34: DHCPD: Sending DHCPOFFER to client 0063.6973.636f.2d30.3030.352e.3565.
3663.2e63.3065.302d.4574.302f.30 (78.78.78.2).
00:03:34: DHCPD: child pool: 78.78.78.0 / 255.255.255.0 (POOL1)
00:03:34: DHCPD: pool POOL1 has no parent.
00:03:34: DHCPD: child pool: 78.78.78.0 / 255.255.255.0 (POOL1)
00:03:34: DHCPD: pool POOL1 has no parent.
00:03:34: DHCPD: broadcasting BOOTREPLY to client 0005.5e6c.c0e0.
00:03:34: DHCPD: DHCPREQUEST received from client 0063.6973.636f.2d30.3030.352e.
3565.3663.2e63.3065.302d.4574.302f.30.
00:03:34: DHCPD: Sending DHCPACK to client 0063.6973.636f.2d30.3030.352e.3565.36
63.2e63.3065.302d.4574.302f.30 (78.78.78.2).
00:03:34: DHCPD: child pool: 78.78.78.0 / 255.255.255.0 (POOL1)
00:03:34: DHCPD: pool POOL1 has no parent.
00:03:34: DHCPD: child pool: 78.78.78.0 / 255.255.255.0 (POOL1)
00:03:34: DHCPD: pool POOL1 has no parent.
00:03:34: DHCPD: broadcasting BOOTREPLY to client 0005.5e6c.c0e0.
</SNIP>
 
The MAC address of the requesting client is 0005.5e6c.c0e0 and R7 knows that (as you can see from the debugs). But why the heck would the initial request appear to come from the following MAC Address:
 
0063.6973.636f.2d30.3030.352e.3565.3663.2e63.3065.302d.4574.302f.30
 
Where does this address even come from? Is there any correlation to the "real" MAC address?
 
Here is the "show ip dhcp bindings" table:
 
<SNIP>
r7#show ip dhcp binding
IP address Client-ID/ Lease expiration Type
'''''''''''''''''Hardware address
78.78.78.2 0063.6973.636f.2d30. Mar 02 1993 12:03 AM Automatic
'''''''''''''''''3030.352e.3565.3663.
'''''''''''''''''2e63.3065.302d.4574.
'''''''''''''''''302f.30
</SNIP>
(cut/paste this into notepad to view table properly)
 
Thanks in advance,
Ken



This archive was generated by hypermail 2.1.4 : Sun Aug 01 2004 - 10:11:45 GMT-3