From: Kenneth Wygand (KWygand@customonline.com)
Date: Fri Jul 02 2004 - 16:11:26 GMT-3
Thanks Tom. Do you happen to know how the client ID is derived?
Ken
________________________________
From: Tom Martin [mailto:tig@wiltecinc.com]
Sent: Fri 7/2/2004 2:14 PM
To: ccielab@groupstudy.com
Cc: Kenneth Wygand
Subject: RE: Weird MAC in DHCP request
Ken,
The DHCP client ID is not the same thing as the MAC. Each are
represented by their own fields in the DHCP packet. The DHCP RFC
requires that the station ID always be the same for a given host, where
the MAC address be the L2 address of the interface requesting an
address. For PCs and servers, you'll see the that they are usually the
same since (assuming a single NIC is present) the MAC will uniquely
identify the host.
The important point is that although both fields often carry the same
value, they don't have to match. For routers with multiple LAN
interfaces, use of the MAC address of the DHCP interface does not
uniquely represent the device. Cisco devices use a client ID that
resembles a very long MAC, but the client ID and MAC are not related.
For what it's worth, the client ID doesn't even have to resemble a MAC
(it can be any arbitrary string)...
-- Tom
-----Original Message-----
From: nobody@groupstudy.com [mailto:nobody@groupstudy.com] On Behalf Of
Kenneth Wygand
Sent: Friday, July 02, 2004 1:14 PM
To: ccielab@groupstudy.com
Subject: Weird MAC in DHCP request
R7(e0/0)----------(e0/0)R8
R8 is requesting an address through DHCP from R7. The followind debug
output is observed on R7:
<SNIP>
00:03:32: DHCPD: DHCPDISCOVER received from client
0063.6973.636f.2d30.3030.352e
.3565.3663.2e63.3065.302d.4574.302f.30 on interface Ethernet0/0.
00:03:34: DHCPD: assigned IP address 78.78.78.2 to client
0063.6973.636f.2d30.30
30.352e.3565.3663.2e63.3065.302d.4574.302f.30.
00:03:34: DHCPD: Sending DHCPOFFER to client
0063.6973.636f.2d30.3030.352e.3565.
3663.2e63.3065.302d.4574.302f.30 (78.78.78.2).
00:03:34: DHCPD: child pool: 78.78.78.0 / 255.255.255.0 (POOL1)
00:03:34: DHCPD: pool POOL1 has no parent.
00:03:34: DHCPD: child pool: 78.78.78.0 / 255.255.255.0 (POOL1)
00:03:34: DHCPD: pool POOL1 has no parent.
00:03:34: DHCPD: broadcasting BOOTREPLY to client 0005.5e6c.c0e0.
00:03:34: DHCPD: DHCPREQUEST received from client
0063.6973.636f.2d30.3030.352e.
3565.3663.2e63.3065.302d.4574.302f.30.
00:03:34: DHCPD: Sending DHCPACK to client
0063.6973.636f.2d30.3030.352e.3565.36
63.2e63.3065.302d.4574.302f.30 (78.78.78.2).
00:03:34: DHCPD: child pool: 78.78.78.0 / 255.255.255.0 (POOL1)
00:03:34: DHCPD: pool POOL1 has no parent.
00:03:34: DHCPD: child pool: 78.78.78.0 / 255.255.255.0 (POOL1)
00:03:34: DHCPD: pool POOL1 has no parent.
00:03:34: DHCPD: broadcasting BOOTREPLY to client 0005.5e6c.c0e0.
</SNIP>
The MAC address of the requesting client is 0005.5e6c.c0e0 and R7 knows
that (as you can see from the debugs). But why the heck would the
initial request appear to come from the following MAC Address:
0063.6973.636f.2d30.3030.352e.3565.3663.2e63.3065.302d.4574.302f.30
Where does this address even come from? Is there any correlation to the
"real" MAC address?
Here is the "show ip dhcp bindings" table:
<SNIP>
r7#show ip dhcp binding
IP address Client-ID/ Lease expiration Type
'''''''''''''''''Hardware address
78.78.78.2 0063.6973.636f.2d30. Mar 02 1993 12:03 AM
Automatic
'''''''''''''''''3030.352e.3565.3663.
'''''''''''''''''2e63.3065.302d.4574.
'''''''''''''''''302f.30
</SNIP>
(cut/paste this into notepad to view table properly)
Thanks in advance,
Ken
This archive was generated by hypermail 2.1.4 : Sun Aug 01 2004 - 10:11:45 GMT-3