Odd syslog entry

[Easy Limits]

I have been seeing this occasionally since the start of the new year in my syslog. My network addresses are the usual 192.168.x.x. I have a AC56U running Merlin's latest and I also experienced these weird entries when I had Merlin 380.59. The MAC addresses are unknown to me and I am seeing different ones.

Jan 25 16:00:04 dnsmasq-dhcp[21298]: DHCPREQUEST(br0) 10.113.113.83 10:ae:60:7b:c8:a7
Jan 25 16:00:04 dnsmasq-dhcp[21298]: DHCPNAK(br0) 10.113.113.83 10:ae:60:7b:c8:a7 wrong network
Jan 25 16:00:15 dnsmasq-dhcp[21298]: DHCPDISCOVER(br0) 10:ae:60:7b:c8:a7

Any ideas what this could be? I have the router buttoned up security wise. No Samba, VPN or anything else running.

 

[evh909]

br0 is your wan port, so it looks like it is doing a dhcp request from your ISP. Does that look like your external IP address?

 

[RMerlin]

br0 is your wan port, so it looks like it is doing a dhcp request from your ISP. Does that look like your external IP address?

No, br0 is the LAN, bridging Ethernet and wireless.

 

[RMerlin]

I have been seeing this occasionally since the start of the new year in my syslog. My network addresses are the usual 192.168.x.x. I have a AC56U running Merlin's latest and I also experienced these weird entries when I had Merlin 380.59. The MAC addresses are unknown to me and I am seeing different ones.

Jan 25 16:00:04 dnsmasq-dhcp[21298]: DHCPREQUEST(br0) 10.113.113.83 10:ae:60:7b:c8:a7
Jan 25 16:00:04 dnsmasq-dhcp[21298]: DHCPNAK(br0) 10.113.113.83 10:ae:60:7b:c8:a7 wrong network
Jan 25 16:00:15 dnsmasq-dhcp[21298]: DHCPDISCOVER(br0) 10:ae:60:7b:c8:a7

Any ideas what this could be? I have the router buttoned up security wise. No Samba, VPN or anything else running.

That MAC is from a private range, best guess would be it's a virtual machine, or someone having manually changed his MAC.

Those DHCPNAK messages typically occur on roaming, i.e. when you have a phone that last got a DHCP lease at the office, and you bring it home, and it first tries to reuse the same IP as before.

 

[pattiri]

or there is a device in your LAN with manually assigned IP address with 10.113.113.83 and this device asks your router to use this IP address and your router says; "no"

 

[Easy Limits]

Could it be a sign of infection?

 

[RMerlin]

Could it be a sign of infection?

That would be surprising. The behaviour wouldn't match that of a malware.

 

[Easy Limits]

How about this one?

Jan 26 15:50:01 dnsmasq-dhcp[21298]: DHCPSOLICIT(br0) 00:01:00:01:1a:8f:13:35:54:04:a6:27:f4:ee

 

[ColinTaylor]

How about this one?

Jan 26 15:50:01 dnsmasq-dhcp[21298]: DHCPSOLICIT(br0) 00:01:00:01:1a:8f:13:35:54:04:a6:27:f4:ee

It's a DHCPv6 client attempting to discover the location of a DHCPv6 server.

 

[vikingsam]

That MAC is from a private range, best guess would be it's a virtual machine, or someone having manually changed his MAC.

Those DHCPNAK messages typically occur on roaming, i.e. when you have a phone that last got a DHCP lease at the office, and you bring it home, and it first tries to reuse the same IP as before.

That explanation makes sense to me. I have seen the same "wrong network" message in my logs a few times. I think it is usually from a device that has connected somewhere else and is now rejoining my network.