Topic: DHCPD Bootrequests

[Lloyd Keen]

Anyone got any ideas what could be causing these messages:

Dec 27 14:24:44 server dhcpd: BOOTREQUEST from 00:00:a2:f3:e7:e0 via eth0 (non-rfc1048)
Dec 27 14:24:44 server dhcpd: No applicable record for BOOTP host 00:00:a2:f3:e7:e0 via eth0
Dec 27 14:25:44 server dhcpd: BOOTREQUEST from 00:00:a2:f3:e7:e0 via eth0 (non-rfc1048)
Dec 27 14:25:44 server dhcpd: No applicable record for BOOTP host 00:00:a2:f3:e7:e0 via eth0
Dec 27 14:26:44 server dhcpd: BOOTREQUEST from 00:00:a2:f3:e7:e0 via eth0 (non-rfc1048)
Dec 27 14:26:44 server dhcpd: No applicable record for BOOTP host 00:00:a2:f3:e7:e0 via eth0
Dec 27 14:27:44 server dhcpd: BOOTREQUEST from 00:00:a2:f3:e7:e0 via eth0 (non-rfc1048)
Dec 27 14:27:44 server dhcpd: No applicable record for BOOTP host 00:00:a2:f3:e7:e0 via eth0

I've done an arp -a but this mac address isn't in the list. Could it be in the bios of one of the machines. Maybe one of the NIC's in the server? Anyone have any ideas? Is there a command to suppress BOOTREQUEST logging?

[Rob Hillis]

Lloyd Keen wrote:

> Anyone got any ideas what could be causing these messages:
>
> Dec 27 14:24:44 server dhcpd: BOOTREQUEST from
> 00:00:a2:f3:e7:e0 via eth0 (non-rfc1048)
> Dec 27 14:24:44 server dhcpd: No applicable record for BOOTP

[...]

This looks to me like you've got a machine on the network that's trying to boot from the network as part of it's startup procedure.  Obviously you've not set up your SME server to answer these requests.

Easy way to kill these is to find a machine with a bootrom, or with BOOTP capabilities (I know some later Intel cards have this built in) and disable it, either via the machine's BIOS or through the network card's setup program.

[Patrick Basile]

Lloyd,

Rob is right on track with his analysis/suggestions.  One other thing perhaps:  I had this same problem a few months ago with a client, and it turns out it was one of their Cisco managed switches (I forget the model) which was looking for an IP.  So remember, it might be a PC - but it could really be any other device, e.g. switch/printer.

Good luck.  Regards,

Patrick

[Dan G.]

I had an old CiscoPro Etherswitch that was spewing STP poop all over the place --- I found it with EtherApe and Ethereal.  Setting Ethereal to resolve names returned a device named something like Grand_45:67:02:88  --- which helped me identify the actual device.  That particular model was from the era when Cisco had just acquired Grand Juction Networks --- thus the name.

Dan

[Lloyd Keen]

Thanks guys,
I hadn't even thought about the switch. It's a bay networks model, seeing as there are no NW printers or the like I might start looking in that direction.