[c-nsp] Embeded Packet Capture for DHCP Troubleshooting

[Heath Jones]

Is the switch in the middle doing anything 'funky', or just pretty bog standard?
Are the clients configured to accept any dhcp response, or are they
locked down in any way?

If the ethernet port is flapping according to the client, it may make
new requests when the link comes back up each time..
If a client sees a gratuitous arp or packet from another host with the
same IP address, it may drop the lease and request a new one..

It sounds like it works though, they get the IP, but just keep asking
when they don't need to (before dhcp lease expiry) ??



On 21 September 2010 16:31, Jeff Wojciechowski
<Jeff.Wojciechowski at midlandpaper.com> wrote:
> Yessir – IPV4.
>
>
>
> Basically the debugging on the router kept showing the IPV4 address being
> offered to the particular client over and over again – that’s why I wanted
> the packet capture to dig into the issue a little deeper.
>
>
>
> Thanks,
>
>
>
> -Jeff
>
>
>
> From: Heath Jones [mailto:hj1980 at gmail.com]
> Sent: Tuesday, September 21, 2010 10:28 AM
>
>
>
> It's a L2 & L3 broadcast for requests, then unicast for replies. The clients
> will never have IP addresses before they get a lease from the DHCP server -
> that is what a DHCP lease is (on v4). Are you talking about IPv4?
>
> So your saying that at some point in time the clients are issuing dhcp
> requests, but not seeing replies?
>
>
>
>
>
> On 21 September 2010 16:23, Jeff Wojciechowski
> <Jeff.Wojciechowski at midlandpaper.com> wrote:
>
> 2801 is doing dhcp - and I wanted to get a packet capture to see why 2 thin
> clients won't get dhcp leases successfully from the 2801 upon boot up (so
> before the client has an ip from dhcp - isn't the dhcp transaction all arp?)
>
>
> Sent from Midland Paper Company's Blackberry Server
>
>
> From: Heath Jones [mailto:hj1980 at gmail.com]
> Sent: Tuesday, September 21, 2010 10:12 AM
> To: Jeff Wojciechowski
> Cc: cisco-nsp at puck.nether.net <cisco-nsp at puck.nether.net>
> Subject: Re: [c-nsp] Embeded Packet Capture for DHCP Troubleshooting
>
>
> I just re-read and saw it was the 2601 as the dhcp server.
>
>
>
> What problem are you trying to solve?
>
> On 21 September 2010 16:10, Heath Jones <hj1980 at gmail.com> wrote:
>
> Hi Jeff - which device is performing the dhcp server function and what
> problem are you actually having?
>
>
>
> On 21 September 2010 15:46, Jeff Wojciechowski
> <Jeff.Wojciechowski at midlandpaper.com> wrote:
>
> All:
>
> I would like to use Embedded Packet Capture at a remote site to troubleshoot
> IOS DHCP at a remote site.
>
> (referencing
> http://www.cisco.com/en/US/docs/ios/netmgmt/configuration/guide/nm_packet_capture_ps6441_TSD_Products_Configuration_Guide_Chapter.html#wp1060070)
>
> The concept looks pretty straightforward but since DHCP negotiation isn't IP
> - I am having trouble with building the access list to determine what
> traffic to capture.
>
> The device I would like to perform the capture on is a 2801 and that is the
> device serving DHCP to clients at that site.
>
> Utilization on that router is pretty low so if I *had* to capture all
> traffic on F0/0 and dump it via TFTP to the fileserver at the site - I think
> that might be a viable option? But the fileserver is connected to the switch
> that connected to F0/0 that I want to perform the capture on.
>
> Regular DHCP debugs only show that 2 devices are continually offered IPs but
> then apparently keep re-requesting them. (So maybe I am barking up the wrong
> tree here.)
>
> Diagram:
>
> WAN----Serial-2801-F0/0----Switch------DHCP Clients and Fileserver
>
> Any and all hints would be greatly appreciated.
>
> Thanks much,
>
> Jeff Wojciechowski
> LAN, WAN and Telephony Administrator
> Midland Paper Company
> 101 E Palatine Rd
> Wheeling, IL 60090
> * tel: 847.777.2829
> * fax: 847.403.6829
> e-mail:
> jeff.wojciechowski at midlandpaper.com<mailto:jeff.wojciechowski at midlandpaper.com>
> http://www.midlandpaper.com
>
>
>
>
>  ________________________________
> This electronic mail (including any attachments) may contain information
> that is privileged, confidential, or otherwise protected from disclosure to
> anyone other than its intended recipient(s). Any dissemination or use of
> this electronic mail or its contents (including any attachments) by persons
> other than the intended recipient(s) is strictly prohibited. If you have
> received this message in error, please delete the original message in its
> entirety (including any attachments) and notify us immediately by reply
> email so that we may correct our internal records. Midland Paper Company
> accepts no responsibility for any loss or damage from use of this electronic
> mail, including any damage resulting from a computer virus.
> _______________________________________________
> cisco-nsp mailing list  cisco-nsp at puck.nether.net
> https://puck.nether.net/mailman/listinfo/cisco-nsp
> archive at http://puck.nether.net/pipermail/cisco-nsp/
>
>
>
>
>
> ________________________________
>
> This electronic mail (including any attachments) may contain information
> that is privileged, confidential, or otherwise protected from disclosure to
> anyone other than its intended recipient(s). Any dissemination or use of
> this electronic mail or its contents (including any attachments) by persons
> other than the intended recipient(s) is strictly prohibited. If you have
> received this message in error, please delete the original message in its
> entirety (including any attachments) and notify us immediately by reply
> email so that we may correct our internal records. Midland Paper Company
> accepts no responsibility for any loss or damage from use of this electronic
> mail, including any damage resulting from a computer virus.
>
>
>
> To: Jeff Wojciechowski
> Cc: cisco-nsp at puck.nether.net
> Subject: Re: [c-nsp] Embeded Packet Capture for DHCP Troubleshooting
> ________________________________
> This electronic mail (including any attachments) may contain information
> that is privileged, confidential, or otherwise protected from disclosure to
> anyone other than its intended recipient(s). Any dissemination or use of
> this electronic mail or its contents (including any attachments) by persons
> other than the intended recipient(s) is strictly prohibited. If you have
> received this message in error, please delete the original message in its
> entirety (including any attachments) and notify us immediately by reply
> email so that we may correct our internal records. Midland Paper Company
> accepts no responsibility for any loss or damage from use of this electronic
> mail, including any damage resulting from a computer virus.
>