Stopping one device from abusing DHCP

[rseiler]

I have a mystery device somewhere on the network (not a clue who it is--I don't have access to everyone's hardware to start eliminating) that is generating an extreme number of DHCPREQUEST(br-lan)/DHCPACK(br-lan) items in the log.

Blocking in Restrictions has no effect on that traffic, so I thought that I'd add an iptables line to /etc/firewall.user to eventually flush out the device when someone comes to complain:

Code: Select all

iptables -A INPUT -m mac --mac-source XX:XX:XX:XX:XX:XX -j REJECT --reject-with tcp-reset

But it simply has no effect (also tried -j DROP at the end instead).

I tried restarting the firewall both ways (meaning including restart_firewall.sh).

Am I missing something?

[ispyisail]

did you fix the problem?

[rseiler]

No, I never did find a rule to do that kind of specific DHCP block, and I'm not sure that it's even possible.

On why I was looking for it in the first place, DHCP chattiness, I don't think that's Gargoyle-specific but just something endemic in DHCP at times.

There is one fix that I came across which can help if you see Win7 triggering this specific thing (this wasn't what I was seeing though):
http://brielle.sosdg.org/archives/522-W ... sages.html