# [SOLVED] DHCP Broadcast Storm



## nhammen09 (Apr 9, 2013)

I really haven't seen any change in network performance, but I've checked my firewall logs for the last few days, and there are a ton of dropped packets from Src=0.0.0.0 to Dest=255.255.255.255

It appears that it is using ports 67 and 68, and the MAC addresses vary.
How can I find out what is causing this massive broadcast or how do I stop it?

Firewall is a custom desktop PC running IPFire 2.13 Core 70 with a Red & Green interface. It hosts DHCP and acts as a proxy server.


----------



## Wand3r3r (Sep 17, 2010)

*Re: DHCP Broadcast Storm*

Appears to me those two devices at mac addresses ending in :f3 and :81 are asking for dhcp ips but are not getting them.


----------



## nhammen09 (Apr 9, 2013)

*Re: DHCP Broadcast Storm*

I did a Mac Vendor lookup, and it appears that the 2 devices that you had mentioned are Ubiquiti devices. I have a wireless feed on the red interface that goes out to a PPTP but the interface is set to static only. I'm wondering why it might be trying to get an address...

Also, I just rebooted the firewall to see whether rebooting the interface would make a difference. No change.


----------



## Wand3r3r (Sep 17, 2010)

*Re: DHCP Broadcast Storm*

Make sure dhcp relay is disabled on the ubiquiti devices. Otherwise you can get requests across those links.


----------



## nhammen09 (Apr 9, 2013)

*Re: DHCP Broadcast Storm*

I will check on that. I'm having a tech at my ISP check out the Ubiquiti device to find out what's going on. He's has remote access to it, so it'll be interesting to see what he can dig up. It appears that the 2 mac are from the antenna and the wireless tower.


----------



## Wand3r3r (Sep 17, 2010)

*Re: DHCP Broadcast Storm*

Thanks for the update.


----------



## nhammen09 (Apr 9, 2013)

*Re: DHCP Broadcast Storm*

Here's the latest update. The tech did confirm that the devices were Ubiquiti, but they were not my own equipment. He also says that there isn't any extreme amount of traffic over any interfaces associated with those 2 mac addresses. The firewall log does show that it is coming from the WAN, but nothing looks unusual from the ISP side. It seems to be doing it every 4 seconds, but I can't seem to find anything that suggests the storm. Am I just losing it, or is there something else I can check?


----------



## nhammen09 (Apr 9, 2013)

*Re: DHCP Broadcast Storm*

Here's the summary log from midnight to current. The firewall log hasn't changed since yesterday.


----------



## Wand3r3r (Sep 17, 2010)

*Re: DHCP Broadcast Storm*

Every 4 seconds is not "storm" so no worries there. You could just configure your firewall to deny everything from those mac addresses.

Your isp does not seem on top of it. Those requests couldn't get to you unless they have dhcp relay enabled. Without dhcp relay a dhcp request/response never goes past the lan. This is not enabled by default.

Can you logon to ubi unit closest to you? If so look for dhcp relay and disable it.


----------



## nhammen09 (Apr 9, 2013)

*Re: DHCP Broadcast Storm*

I can login and configure by Ubiquiti antenna, but there is no option on at least my side to disable DHCP relay. It is set to bridge mode that relays to the rest of the wireless network. Management is at a [10.] network, so it must be enabled to use NAT before reaching the wireless WAN. I can contact the tech at the ISP again to check whether this can be disabled at the tower relay point.


----------



## Wand3r3r (Sep 17, 2010)

*Re: DHCP Broadcast Storm*

dhcp relay is only in the case of a natted network. Bridge just passes everything thru. You would have to look at the other end of the bridge that is natted to the internet


----------



## nhammen09 (Apr 9, 2013)

*Re: DHCP Broadcast Storm*

Talked to our wireless tech, and he seems to have disabled DHCP relay. Everything appears to be working and the constant request have stopped. Thanks for all your help Wand3r3r!


----------



## Wand3r3r (Sep 17, 2010)

Glad you got it sorted out and thanks for the update!


----------

