Dancing the DHCP Samba

After a hard­ware fail­ure of a Lin­ux com­put­er I took the chance to set up a Debian instal­la­tion from scratch. So I saved the data that was impor­tant to a serv­er, burned the Debian DVD and installed it on the computer.

When it came to net­work­ing it got a lit­tle more com­pli­cat­ed: as the serv­er is using the cor­po­rate net­work, it had to send a spe­cif­ic host name to obtain the IP con­fig­u­ra­tion via DHCP. So that was what I did: I entered the host name and let dhcp­client do its mag­ic. It took some time, but final­ly it was set up. All DNS entries for this host name and its cor­re­spond­ing IP were correct.

My next thought was: now update the pack­ages, get the SSH serv­er up and run­ning and the go back to the office and install the rest via SSH. Unfor­tu­nate­ly the updat­ing was dif­fi­cult, the HTTP con­nec­tion had to be send through a proxy serv­er but some­how the down­loads could not be fin­ished. It was strange how­ev­er, that some­times it worked just fine. I tried to reach the serv­er via SSH but it refused con­nec­tion. The SSH serv­er was run­ning which was checked by log­ging into SSH via local­host. A fire­wall was not yet installed, so what went wrong? The sud­den­ly it worked, EUREKA! But then the SSH ses­sion got reset by peer. Next thing I tried was ping­ing the host, which worked great, even over longer times: no pack­et loss, no dou­ble answers, every­thing fine.

I can­not remem­ber why but just for curios­i­ty I tried to tel­net into the machine, which should not work, because there was just the encrypt­ed ter­mi­nal serv­er avail­able. To my sur­prise I got a log in screen of a UNIX dialect, clear­ly not what I expect­ed. I checked the IP address and it was the Lin­ux server’s address.

It seemed to me that two com­put­ers are try­ing to use the same IP adress. To get a proof for this there is one thing one can look at if the com­put­ers are all in the same LAN: use the arp com­mand to obtain the MAC adress of the cor­re­spond­ing IP and com­pare that with the net­work inter­face’s. The result was obvi­ous: the MAC adress was an unknown one, but after some time it was the one of the Lin­ux box I tried to set up.

The Result

So the sit­u­a­tion was that two com­put­ers were steal­ing each oth­er’s IP. This “IP shar­ing” lead to the effect that for a cer­tain amount of time the Lin­ux box got the IP, until the sec­ond com­put­er request­ed a new IP from the DHCP serv­er because it’s lease expired. Then the IP switched, until the Lin­ux com­put­er’s request­ed its IP and with this it switched back.

The ping­ing worked because both com­put­er answered the pings, which was indis­tin­guish­able from the ping out­put, because it all came from the same IP. This “DHCP Sam­ba” that the two com­put­ers danced took me some time to fig­ure it out, but I am glad that I found it.