{DANGEROUS?} SV: What Exactly Causes "uid lease" Messages?

[Anders Rosendal]

Warning: This message has had one or more attachments removed
Warning: (notnamed).
Warning: Please read the "VirusWarning.txt" attachment(s) for more information.

The issue with duplicate mac's is quite common.
We have on the ISP I work at seen batches of NIC's reaching the market, all with the same MAC. In some case even with MAC 00:00:00:00:00:00. 
This problem seems to be decreasing, it was much more common in 2000-2002.
 
Regards Anders R

________________________________

Från: dhcp-users-bounce at isc.org genom Martin McCormick
Skickat: sö 2008-06-15 04:39
Till: dhcp-users at isc.org
Ämne: Re: What Exactly Causes "uid lease" Messages?



Claus Holm Christensen writes:
> In DHCP, the client is supposed to send both a MAC address and a DHCP
> Client Identifier (called "uid" in the leases file?) to the server, to
> identify the client. The DHCP server should prefer this value over the
> MAC address, but when two hosts on different networks share the Client
> Identifier, the server realises that it can't possibly be the same host
> and emits this error message to warn about it.
>
> It should be easy to find out. Check the leases-file and locate the two
> different leases mentioned, then compare the uid field.

        I did and it is like you describe except for 1 thing.
After picking one at random, I found three leases with the same
UID. They also had the same MAC address. How folks are doing
this I am not sure, but it is as if they have a previous fond
memory of X lease which they sometimes ask for.:-)

        Here is the pair of leases for one client. The hardware
address is the same as well as the UID field.

lease 139.78.228.141 {
  starts 5 2008/06/13 06:07:10;
  ends 5 2008/06/13 06:37:10;
  tstp 5 2008/06/13 06:37:10;
  tsfp 5 2008/06/13 07:22:10;
  atsfp 5 2008/06/13 07:22:10;
  cltt 5 2008/06/13 06:07:10;
  binding state free;
  hardware ethernet 00:15:c5:ac:bd:87;


lease 139.78.228.230 {
  starts 0 2008/06/15 01:16:20;
  ends 0 2008/06/15 01:46:20;
  tstp 0 2008/06/15 01:46:20;
  tsfp 0 2008/06/15 02:31:20;
  atsfp 0 2008/06/15 02:31:20;
  cltt 0 2008/06/15 01:16:20;
  binding state free;
  hardware ethernet 00:15:c5:ac:bd:87;


lease 139.78.231.94 {
  starts 4 2008/06/12 10:12:41;
  ends 2 2008/05/27 17:22:38;
  tstp 4 2008/06/12 10:12:41;
  tsfp 4 2008/06/12 10:12:41;
  atsfp 4 2008/06/12 10:12:41;
  cltt 2 2008/05/27 16:52:38;
  binding state backup;
  hardware ethernet 00:15:c5:ac:bd:87;


lease 139.78.231.177 {
  starts 4 2008/06/12 02:33:31;
  ends 4 2008/06/12 02:35:31;
  tstp 1 2008/04/14 10:15:45;
  tsfp 4 2008/06/12 02:35:31;
  atsfp 4 2008/06/12 02:35:31;
  cltt 4 2008/06/12 02:33:31;
  binding state backup;
  hardware ethernet 00:15:c5:ac:bd:87;



--
This message has been scanned for viruses and
dangerous content by MailScanner on mars.rosendal.nu,
and is believed to be clean.



-------------- next part --------------
This is a message from the MailScanner E-Mail Virus Protection Service
----------------------------------------------------------------------
The original e-mail attachment "winmail.dat"
was believed to be infected by a virus and has been replaced by this warning
message.

If you wish to receive a copy of the *infected* attachment, please
e-mail helpdesk and include the whole of this message
in your request. Alternatively, you can call them, with
the contents of this message to hand when you call.

At Sun Jun 15 09:32:09 2008 the virus scanner said:
   badtnef

Note to Help Desk: Look on the MailScanner in /var/spool/MailScanner/quarantine/20080615 (message 68E2240008C.17F33).
-- 
Postmaster
Rosendal.nu Home
www.rosendal.nu

MailScanner thanks transtec Computers for their support