[DHCPDISCOVER]unknown network segment.

[Glenn Satchell]

On Thu, October 16, 2014 10:12 pm, Simon Hobson wrote:
> Glenn Satchell <glenn.satchell at uniq.com.au> wrote:
>
>> The 'via' part of the log message indicates these two IPs are acting as
>> DHCP relay agents. My guess is that they are two routers with vrrp (or
>> other virtual address) advertising x.x.x.161 as the gateway.
>>
>> What this means is that there is a subnet somewhere on the *other* side
>> pf
>> these routers that is where the client is. It is this other subnet that
>> is
>> not defined so the dhcp server doesn't know how to assign an address.
>> You
>> can check this by using tcpdump to look at the packets - it will have a
>> field with the address of the gateway on that subnet.
>
> That's not right is it ?
> The address given in the "via ..." part should be the GI-Addr field in the
> relayed packet. By definition, that *must* be an IP address configured on
> a relay agent interface on the network to which the client is directly
> attached. If there are any other upstream relay agents, then they would
> have filled in their own GI-Addr field and either :
> 1) unicasted the packets to the server.
> 2) broadcast, but the downstream relay agent would not further mangle the
> GI-Addr field.
>
> A dump & decode of the packets might reveal something.

Simon, you are correct - it is the gi-addr as shown in the source code
snippet below from server/dhcp.c

                log_info("%s from %s via %s: %s", s,
                         (packet->raw->htype
                          ? print_hw_addr(packet->raw->htype,
                                          packet->raw->hlen,
                                          packet->raw->chaddr)
                          : "<no identifier>"),
                         packet->raw->giaddr.s_addr
                         ? inet_ntoa(packet->raw->giaddr)
                         : packet->interface->name, errmsg);

So, more likely these two devices are switches on the local network with a
dhcp relay function. Definitely need packet dumps to see what is going on.

regards,
-glenn