[dhcwg] Source address in Vista DHCP packets.

Simon Kelley <simon@thekelleys.org.uk> Thu, 21 February 2008 11:21 UTC

Return-Path: <dhcwg-bounces@ietf.org>
X-Original-To: ietfarch-dhcwg-archive@core3.amsl.com
Delivered-To: ietfarch-dhcwg-archive@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id EB40928C242; Thu, 21 Feb 2008 03:21:20 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -0.797
X-Spam-Level:
X-Spam-Status: No, score=-0.797 tagged_above=-999 required=5 tests=[AWL=-0.360, BAYES_00=-2.599, FH_RELAY_NODNS=1.451, HELO_MISMATCH_ORG=0.611, RDNS_NONE=0.1]
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 4vqb+MsPNcyu; Thu, 21 Feb 2008 03:21:20 -0800 (PST)
Received: from core3.amsl.com (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 07F2328C2F5; Thu, 21 Feb 2008 03:21:20 -0800 (PST)
X-Original-To: dhcwg@core3.amsl.com
Delivered-To: dhcwg@core3.amsl.com
Received: from localhost (localhost [127.0.0.1]) by core3.amsl.com (Postfix) with ESMTP id 3C09628C4F3 for <dhcwg@core3.amsl.com>; Thu, 21 Feb 2008 03:21:18 -0800 (PST)
X-Virus-Scanned: amavisd-new at amsl.com
Received: from mail.ietf.org ([64.170.98.32]) by localhost (core3.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id hgZy3BRcYROs for <dhcwg@core3.amsl.com>; Thu, 21 Feb 2008 03:21:10 -0800 (PST)
Received: from eyas.biff.org.uk (eyas.biff.org.uk [80.68.92.121]) by core3.amsl.com (Postfix) with ESMTP id D05B83A683B for <dhcwg@ietf.org>; Thu, 21 Feb 2008 03:21:09 -0800 (PST)
Received: from cpc4-cmbg4-0-0-cust687.cmbg.cable.ntl.com ([86.14.238.176] helo=thekelleys.org.uk) by eyas.biff.org.uk with esmtpa (Exim 4.63) (envelope-from <simon@thekelleys.org.uk>) id 1JS9U8-0008OA-Eg for dhcwg@ietf.org; Thu, 21 Feb 2008 11:21:04 +0000
Received: from guest425.wtgc.org ([193.62.205.172]) by thekelleys.org.uk with asmtp (Exim 3.36 #1 (Debian)) id 1JS9U8-0000wG-00 for <dhcwg@ietf.org>; Thu, 21 Feb 2008 11:21:04 +0000
Message-ID: <47BD5E9B.4010709@thekelleys.org.uk>
Date: Thu, 21 Feb 2008 11:20:59 +0000
From: Simon Kelley <simon@thekelleys.org.uk>
User-Agent: Thunderbird 1.5.0.14pre (X11/20071022)
MIME-Version: 1.0
To: dhcwg@ietf.org
X-Enigmail-Version: 0.94.0.0
Subject: [dhcwg] Source address in Vista DHCP packets.
X-BeenThere: dhcwg@ietf.org
X-Mailman-Version: 2.1.9
Precedence: list
List-Id: <dhcwg.ietf.org>
List-Unsubscribe: <http://www.ietf.org/mailman/listinfo/dhcwg>, <mailto:dhcwg-request@ietf.org?subject=unsubscribe>
List-Post: <mailto:dhcwg@ietf.org>
List-Help: <mailto:dhcwg-request@ietf.org?subject=help>
List-Subscribe: <http://www.ietf.org/mailman/listinfo/dhcwg>, <mailto:dhcwg-request@ietf.org?subject=subscribe>
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Sender: dhcwg-bounces@ietf.org
Errors-To: dhcwg-bounces@ietf.org

I've just had some tcpdump output sent to me by someone who is having
problems getting Windows Vista to work with dnsmasq. Vista is emitting
DHCP packets which look like this. There's not enough information to be
sure if they are DISCOVER or REQUEST packets (and what flavour of
REQUEST), but my guess is that they are DISCOVER.


Client Ethernet Address: 00:17:c4:10:9a:3c [|bootp]
17:36:50.527538 IP (tos 0x0, ttl 128, id 442, offset 0, flags [none],
length: 328) 169.254.194.239.68 > 255.255.255.255.67: BOOTP/DHCP,
Request from 00:17:c4:10:9a:3c, length: 300, xid:0xe014ef8f, secs:768,
flags: [Broadcast] (0x8000)


Note that the source address in the IP header is 169.254.194.239 which
is in the APIPA range. I suspect that this is the cause of the problem,
(a badly configured firewall to dumping these packets before they get to
the DHCP server because of their source address), but that is not point
of this post. I think this behaviour is a standards violation.

From RFC 2131:
   DHCP messages broadcast by a client prior to that client obtaining
   its IP address must have the source address field in the IP header
   set to 0.

It looks like the Microsoft DHCP client violates this if DHCP has timed
out at some point and an APIPA address has been selected. Further
attempts at DHCP then have a wrong source address.

So: questions.

1) Has anyone else seen this? Can you clarify the circumstances under
which it occurs?

2) Is this really a standards violation?

3) If it is, does anyone have experience of the best way to report it as
bug to Microsoft?


Cheers,

Simon.



_______________________________________________
dhcwg mailing list
dhcwg@ietf.org
http://www.ietf.org/mailman/listinfo/dhcwg