[Dnsmasq-discuss] Bug-ette Android requesting excessive leases

Discussion:

Ed W

2015-10-23 16:55:06 UTC

Hi

I notice an anomaly with my OnePlus Android phones. They have been
acquiring additional leases for no good reason. Here is a dump from a
little app I have which monitors ARP and dhcp lease allocations:

192.168.105.103/c0:ee:fb:34:64:18 - OnePlus Tech (Shenzhen) Ltd -
android-a837a8c17ea54bc3 - leased until: 2015-10-26T16:34:12 - seen:
2015-10-23T16:39:00
192.168.105.105/c0:ee:fb:34:64:18 - OnePlus Tech (Shenzhen) Ltd - leased
until: 2015-10-24T14:31:08
192.168.105.106/c0:ee:fb:34:64:18 - OnePlus Tech (Shenzhen) Ltd - leased
until: 2015-10-25T16:05:49
192.168.105.115/c0:ee:fb:42:63:b1 - OnePlus Tech (Shenzhen) Ltd - leased
until: 2015-10-24T14:28:00
192.168.105.116/c0:ee:fb:42:63:b1 - OnePlus Tech (Shenzhen) Ltd - leased
until: 2015-10-24T15:34:39
192.168.105.117/c0:ee:fb:42:63:b1 - OnePlus Tech (Shenzhen) Ltd - leased
until: 2015-10-25T12:16:12
192.168.105.118/c0:ee:fb:42:63:b1 - OnePlus Tech (Shenzhen) Ltd -
android-9fe15ff2e8e65398 - leased until: 2015-10-26T15:45:48 - seen:
2015-10-23T16:39:00

DNSMasq 2.75, operating on a bridge br0 of two devices wlan/lan.

What you can see here are my two OnePlus devices have apparently
acquired additional leases for no obvious reason. The "seen" shows that
my arp-ping isn't seeing any answer on the other lease addresses, so we
can be sure it's not a genuine case of multiple IPs per MAC

The relevant config is
dhcp-range=192.168.105.50,192.168.105.150,72h
dhcp-authoritative

Unfortunately I don't have the logs for the allocations (it's on a small
router which logs to memory only).

However, my best guess on what happened is that on lease renewal the
Android device is answering dnsmasq's ping (to check if the IP is free)?

If this is interesting/plausible I can try cranking down my lease times
and record the logs to see if I can catch it in action?

Thanks

Ed W

Albert ARIBAUD

2015-10-23 18:58:40 UTC

Permalink

Hi Ed,

Post by Ed W
Hi
I notice an anomaly with my OnePlus Android phones. They have been
acquiring additional leases for no good reason. Here is a dump from a
192.168.105.103/c0:ee:fb:34:64:18 - OnePlus Tech (Shenzhen) Ltd -
2015-10-23T16:39:00
192.168.105.105/c0:ee:fb:34:64:18 - OnePlus Tech (Shenzhen) Ltd - leased
until: 2015-10-24T14:31:08
192.168.105.106/c0:ee:fb:34:64:18 - OnePlus Tech (Shenzhen) Ltd - leased
until: 2015-10-25T16:05:49
192.168.105.115/c0:ee:fb:42:63:b1 - OnePlus Tech (Shenzhen) Ltd - leased
until: 2015-10-24T14:28:00
192.168.105.116/c0:ee:fb:42:63:b1 - OnePlus Tech (Shenzhen) Ltd - leased
until: 2015-10-24T15:34:39
192.168.105.117/c0:ee:fb:42:63:b1 - OnePlus Tech (Shenzhen) Ltd - leased
until: 2015-10-25T12:16:12
192.168.105.118/c0:ee:fb:42:63:b1 - OnePlus Tech (Shenzhen) Ltd -
2015-10-23T16:39:00
DNSMasq 2.75, operating on a bridge br0 of two devices wlan/lan.
What you can see here are my two OnePlus devices have apparently
acquired additional leases for no obvious reason. The "seen" shows that
my arp-ping isn't seeing any answer on the other lease addresses, so we
can be sure it's not a genuine case of multiple IPs per MAC
The relevant config is
dhcp-range=192.168.105.50,192.168.105.150,72h
dhcp-authoritative
Unfortunately I don't have the logs for the allocations (it's on a small
router which logs to memory only).
However, my best guess on what happened is that on lease renewal the
Android device is answering dnsmasq's ping (to check if the IP is free)?
If this is interesting/plausible I can try cranking down my lease times
and record the logs to see if I can catch it in action?

Problem is, we don't see what IP is requested, nor do we see which DHCP
requests or replies are sent.

Can you ssh to your server from your desktop machine? If yes, then you
should do so, then through this shell, kill the background dnsmasq and
launch it in the foreground (with -d, and -q --log-dhcp too). Make sure
you log your ssh session.

This way, we would have a much more detailed log without straining your
router's logging capabilities.

Post by Ed W
Thanks
Ed W

Amicalement,

--
Albert.

Carlos Carvalho

2015-10-23 19:41:01 UTC

Permalink

Post by Albert ARIBAUD
Hi Ed,

Problem is, we don't see what IP is requested, nor do we see which DHCP
requests or replies are sent.

Yes. Also, how do you know the client didn't release the address before
requesting another one?

Post by Albert ARIBAUD
Can you ssh to your server from your desktop machine? If yes, then you
should do so, then through this shell, kill the background dnsmasq and
launch it in the foreground (with -d, and -q --log-dhcp too). Make sure
you log your ssh session.

Good idea.