ER605 v2 sending ARP announce after getting IP on WAN causes DHCP decline and not connecting to WAN
ER605 v2 sending ARP announce after getting IP on WAN causes DHCP decline and not connecting to WAN
Hi there,
After getting fiber to the home I switched to the ER605v2 but cannot get it to connect to the WAN. It just didn't get an IP from my ISP's DHCP. After trying a lot of things and contacting my ISP I still haven't gotten it to work. Last weekend I spent some more time on that and did some packet inspection via interface mirroring and found some interesting things.
The router is doing a normal DHCP discover and recieves a IP normally. After the server sends the DHCP ACK the router then sends an ARP gratuitous annouce that it now has that IP adress. This causes my ISP to send an ARP response with their MAC adress and the router's IP address as sender and the routers MAC and IP as dest which indicates an ARP collision (which it isn't, cause it's sending the MAC of the WAN port). This causes the router to send a DHCP decline though, cause I assume it thinks the IP is already in use. Maybe this is causing some ARP protection to kick in on my ISP. This repeats over and over again. I'm no network expert, I just did some research and found that regarding RFC 5227 it should apparently first do an ARP probe to check if the IP is use before announcing itself. Also the ISP is doing an ARP probe before it sends the router the IP so it can't be duplicate.
I also traced when I hooked my laptop up to the modem directly and it just sends an ARP probe after recieving the IP. There i get no ISP response so it just works.
Overview of the packet trace (replaced actual adresses with placeholders):
No. Time Source Destination Protocol Length Info
31419 255.089218 0.0.0.0 255.255.255.255 DHCP 342 DHCP Discover - Transaction ID 0x88269d46
31641 256.094493 ISP-IP 255.255.255.255 DHCP 437 DHCP Offer - Transaction ID 0x88269d46
31847 257.119227 0.0.0.0 255.255.255.255 DHCP 342 DHCP Request - Transaction ID 0x88269d46
31849 257.147154 ISP-IP 255.255.255.255 DHCP 437 DHCP ACK - Transaction ID 0x88269d46
32098 258.187002 WAN-MAC Broadcast ARP 60 ARP Announcement for WAN-IP
32099 258.188406 ISP-MAC WAN-MAC ARP 60 Gratuitous ARP for WAN-IP (Reply) (duplicate use of WAN-IP detected!)
32101 258.249445 0.0.0.0 255.255.255.255 DHCP 342 DHCP Decline - Transaction ID 0x4830755f
The ARP response from my ISP:
Address Resolution Protocol (reply/gratuitous ARP)
Hardware type: Ethernet (1)
Protocol type: IPv4 (0x0800)
Hardware size: 6
Protocol size: 4
Opcode: reply (2)
[Is gratuitous: True]
Sender MAC address: ISP-MAC
Sender IP address: WAN-IP
Target MAC address: WAN-MAC
Target IP address: WAN-IP
[Duplicate IP address detected for WAN-IP (ISP-MAC) - also in use by WAN-MAC (frame 32098)]
[Frame showing earlier use of IP address: 32098]
[Seconds since earlier frame seen: 0]
I'm not sure if this is a standard practice so my question is if this is a firmware bug or if my ISP is just sending a nonsense response?
I'm at my wits end and I'll also forward this to my ISP.
Any help is appreciated and please correct me if my assumptions are wrong.
- Copy Link
- Subscribe
- Bookmark
- Report Inappropriate Content
Hi @jakobp
Thanks for posting in our business forum.
jakobp wrote
Hi @Clive_A
Thanks for the reply.
From what I understand it should ARP probe the IP a few times before it sends the ARP announce. At least form what I read in the RFC. I'm no expert though, just trying to understand what might be going wrong.
Yes I get an IP address in the same network segment. I can also see the non working router going through that DHCP offer/decline every few seconds trying with different adresses.
My ISP is also looking into the issue now, so maybe they can also resolve the issue on their end.
RFC is a basic standard for vendors to comply with. But some vendors do not follow this order to announce or it does not affect the usage.
Will keep an eye on your ISP followup if you get back to us.
- Copy Link
- Report Inappropriate Content
I've been doing some Wireshark captures with various devices to see how they process DHCP/ARP requests.
My ISP uses PPPoE so I can't test with that, but I've tested connecting devices to the LAN on my Openwrt router.
Of the four devices, a Draytek 2830 router, TpLink W9970, Windows 11 & Debian Bookworm Linux system, only the Windows 11 system actually adheres to RFC5227 and sends ARP probes.
The Draytek, after getting the DHCP assisgnment, sends an ARP 'Who has' for its default gateway, which means its ARP announce for its allocated IP is delayed for around a second.
The TpLink W9970, after getting the DHCP assisgnment, sends an immediate ARP announce for its allocated IP in about 4 milliseconds.
The Debian system has a static IP, but on startup it initially sends an ARP 'Who has' for its default gateway. About 5 secsonds later the gateway sends a 'Who has' for the debian system IP and it responds. No ARP announcement is made, probably correct for a static IP.
The Win11, after getting the DHCP assisgnment, sends an ARP 'Who has' for its default gateway, having got a response to that , its sends out 3 ARP probes for its allocated IP and eventually send an ARP announcement some 4 seconds later.
Not sure what, if any, conclusions one can infer from that, but it would seem that some devices can send the ARP announce quicker than others.
- Copy Link
- Report Inappropriate Content
Thank you all for your help and investigations. My ISP could fix it in their backend. Because I'm curious, I asked them if they could tell me what the issue was, so I'm waiting on their response.
- Copy Link
- Report Inappropriate Content
I'd be interested to hear what they have to say.
Most ISPs use a DHCP Relay agent because their DHCP server is on an internal network and not accessible directly from a users connection.
I wonder whether the fact that the ER605 is sending the ARP announce so quickly is confusing their relay agent. It shouldn't be but who knows...
- Copy Link
- Report Inappropriate Content
Information
Helpful: 0
Views: 784
Replies: 14
Voters 0
No one has voted for it yet.