Page 1 of 1

too many DHCP requests.

Posted: Fri Dec 15, 2023 12:52 am
by NgcJim
Is it usual to have so many DHCP requests? I have hundreds of DHCP requests in my router log every day. I have mostly Reolink and some Amcrests. I have then all on fixed IP addresses and assigned the fixed IP also in the camera. Most all are POE Wired. Only 3 cameras are wireless.

[DHCP IP: 192.168.1.103] to MAC address 5c:cf:7f:36:d7:73, Monday, July 31, 2023 03:40:43
[DHCP IP: 192.168.1.174] to MAC address c8:9e:43:81:d9:11, Monday, July 31, 2023 03:39:36
[DHCP IP: 192.168.1.154] to MAC address 2c:f0:5d:c7:ea:94, Monday, July 31, 2023 03:37:19
[DHCP IP: 192.168.1.162] to MAC address 00:09:b0:f1:4d:14, Monday, July 31, 2023 03:37:18
[DHCP IP: 192.168.1.148] to MAC address 28:29:86:58:74:19, Monday, July 31, 2023 03:36:26
[DHCP IP: 192.168.1.103] to MAC address 5c:cf:7f:36:d7:73, Monday, July 31, 2023 03:26:59
[DHCP IP: 192.168.1.172] to MAC address 38:f9:d3:5a:11:8a, Monday, July 31, 2023 03:21:55
[DHCP IP: 192.168.1.103] to MAC address 5c:cf:7f:36:d7:73, Monday, July 31, 2023 02:36:46
...

Thanks
/Jim

Re: too many DHCP requests.

Posted: Fri Dec 15, 2023 8:32 pm
by TimG
If they have static IP addresses, are you sure their addresses are not in the range used by DHCP ?

Re: too many DHCP requests.

Posted: Sat Dec 16, 2023 1:18 am
by Pogo
That's very not normal.

And none of those MAC addresses are cameras..., at least not Reolink or Amcrest.

Espressi, Netgear, MicroStar Intl, Onkyo, APC, Apple..., those are the companies associated with the MAC addresses you provided.

More info about your setup is required to sort this out, and it needs sorted out..., starting with how you're connected to the internet and whether the companies listed above mean anything to you or are associated with any actual devices on your network.

There's a good chance this is originating outside your home network as a DCHP starvation attack on your DHCP server. If you disconnect your router from your connection to the outside world and the requests stop, you have some shoring up to do on your security perimeter.

Re: too many DHCP requests.

Posted: Sat Dec 16, 2023 2:30 am
by NgcJim
Embarrassing. You are so right. I just jumped to the conclusion that it was my cameras. Two of the IPs have since disappeared from my router's list.

They are 103 (Purple Air meter, 174?, 154=Peleton exercise bike, 162 is my iPhone, .148=?, 172 is MacNookAir,

thanks for setting me straight.

Re: too many DHCP requests.

Posted: Sat Dec 16, 2023 2:35 am
by Pogo
Good luck getting it sorted out.

Google 'DHCP Starvation Attack' for additional insight to what you may have on your plate. Could be other similar stuff, but I'd start there given the symptoms you describe.