Subject: [69ATTENDEES] DHCP

From: "Eric Burger" <[email-masked]>
Date: Tue, 24 Jul 2007 08:08:45 -0700

Anyone having trouble acquiring a network address over 802.11?  We had massive trouble yesterday in Monroe, and today I'm having trouble in Red Laquer. I can connect to ietf, ietf-a, ietf.1x, and ietf-a.1x, but I cannot acquire an address. Yes, IPv4.

--
Sent from my wireless e-mail device. Sorry if terse.  We all need lemonade: see <http://www.standardstrack.com/ietf/lemonade> for what lemonade is.

Notice:  This email message, together with any attachments, may contain information  of  BEA Systems,  Inc.,  its subsidiaries  and  affiliated entities,  that may be confidential,  proprietary,  copyrighted  and/or legally privileged, and is intended solely for the use of the individual or entity named in this message. If you are not the intended recipient, and have received this message in error, please immediately return this by email and then delete it.

_______________________________________________
69ATTENDEES mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/69attendees

---

From: Stephen Casner <[email-masked]>
Date: Tue, 24 Jul 2007 08:11:49 -0700 (PDT)

On Tue, 24 Jul 2007, Eric Burger wrote:

> Anyone having trouble acquiring a network address over 802.11?  We
> had massive trouble yesterday in Monroe, and today I'm having
> trouble in Red Laquer. I can connect to ietf, ietf-a, ietf.1x, and
> ietf-a.1x, but I cannot acquire an address. Yes, IPv4.

Yes, sitting in the terminal room, using ietf-a, it took a long time
to get an address:

DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 5
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 8
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 20
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 16
DHCPOFFER from 130.129.80.3
DHCPREQUEST on ath0 to 255.255.255.255 port 67
DHCPREQUEST on ath0 to 255.255.255.255 port 67
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 6
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 9
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 9
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 17
DHCPOFFER from 130.129.80.3
DHCPOFFER from 130.129.80.2
DHCPOFFER already seen.
DHCPREQUEST on ath0 to 255.255.255.255 port 67
DHCPREQUEST on ath0 to 255.255.255.255 port 67
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 7
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 13
DHCPOFFER from 130.129.80.3
DHCPREQUEST on ath0 to 255.255.255.255 port 67
DHCPREQUEST on ath0 to 255.255.255.255 port 67
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 7
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 7
DHCPOFFER from 130.129.80.3
DHCPOFFER from 130.129.80.2
DHCPOFFER already seen.
DHCPREQUEST on ath0 to 255.255.255.255 port 67
DHCPREQUEST on ath0 to 255.255.255.255 port 67
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 8
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 16
DHCPOFFER from 130.129.80.3
DHCPOFFER from 130.129.80.2
DHCPOFFER already seen.
DHCPREQUEST on ath0 to 255.255.255.255 port 67
DHCPREQUEST on ath0 to 255.255.255.255 port 67
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 5
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 7
DHCPDISCOVER on ath0 to 255.255.255.255 port 67 interval 16
DHCPOFFER from 130.129.80.3
DHCPOFFER from 130.129.80.2
DHCPOFFER already seen.
DHCPREQUEST on ath0 to 255.255.255.255 port 67
DHCPREQUEST on ath0 to 255.255.255.255 port 67
DHCPACK from 130.129.80.3
bound to 130.129.82.120 -- renewal in 10800 seconds.

                                                        -- Steve

---

From: "Winterbottom, James" <[email-masked]>
Date: Tue, 24 Jul 2007 10:13:59 -0500

I trouble first up this morning in Red Laquer.
A repair and renew seemed to fix it though

Cheers
James

> -----Original Message-----
> From: Eric Burger [mailto:[email-masked]]
> Sent: Wednesday, 25 July 2007 1:09 AM
> To: [email-masked]
> Subject: [69ATTENDEES] DHCP
> 
> Anyone having trouble acquiring a network address over 802.11?  We had
> massive trouble yesterday in Monroe, and today I'm having trouble in
Red
> Laquer. I can connect to ietf, ietf-a, ietf.1x, and ietf-a.1x, but I
> cannot acquire an address. Yes, IPv4.
> 
> --
> Sent from my wireless e-mail device. Sorry if terse.  We all need
> lemonade: see <http://www.standardstrack.com/ietf/lemonade> for what
> lemonade is.
> 
> Notice:  This email message, together with any attachments, may
contain
> information  of  BEA Systems,  Inc.,  its subsidiaries  and
affiliated
> entities,  that may be confidential,  proprietary,  copyrighted
and/or
> legally privileged, and is intended solely for the use of the
individual
> or entity named in this message. If you are not the intended
recipient,
> and have received this message in error, please immediately return
this by
> email and then delete it.
> 

------------------------------------------------------------------------------------------------
This message is for the designated recipient only and may
contain privileged, proprietary, or otherwise private information.  
If you have received it in error, please notify the sender
immediately and delete the original.  Any unauthorized use of
this email is prohibited.
------------------------------------------------------------------------------------------------
[mf2]

---

From: Otmar Lendl <[email-masked]>
Date: Tue, 24 Jul 2007 17:14:47 +0200

On 2007/07/24 17:07, Eric Burger <[email-masked]> wrote:
> Red Laquer. I can connect to ietf, ietf-a, ietf.1x, and ietf-a.1x, but
> I cannot acquire an address. Yes, IPv4.
>

It took a few minutes to get an v4 address in Monroe just now.

/ol
-- 
-=-  Otmar Lendl  --  [email-masked]  -=-

---

From: Andrew McGregor <[email-masked]>
Date: Tue, 24 Jul 2007 10:14:51 -0500

I did notice that two of us sitting in the Grand Ballroom got  
addresses within a second or so, after a delay of a few minutes.

Andrew

---

From: Morgan Sackett <[email-masked]>
Date: Tue, 24 Jul 2007 10:14:29 -0500

Hi all,

We are aware of the issues with DHCP and are working through the  
problem.  We will send out an update when we have more information.

Morgan

> bound to 130.129.82.120 -- renewal in 10800 seconds.

Morgan Sackett
VP of Engineering

VeriLAN Event Services, Inc.
215 SE Morrison Street Suite 2000F
Portland, OR 97214

Tel: 503 224-8822
Fax: 503 224-8833
Cell: 503 969-2154

[email-masked]
www.verilan.com

This e-mail contains proprietary information and may be confidential.  
If you are not the intended recipient of this e-mail, you are hereby  
notified that any dissemination, distribution or copying of this  
message is strictly prohibited. If you received this message in  
error, please delete it immediately.

---

From: Jun-ichiro itojun Hagino <[email-masked]>
Date: Wed, 25 Jul 2007 00:19:37 +0900

good reason to use IPv6 entirely, as long as you have IPv6 DNS server:-P

itojun

---

From: Derek Atkins <[email-masked]>
Date: Tue, 24 Jul 2007 11:20:29 -0400

> It took a few minutes to get an v4 address in Monroe just now.

I was having trouble yesterday.  It seems to take a long time just to
get the DHCPOFFER, and even then it doesn't seem to always accept the
immediate DHCPREQUEST.  This was on ietf-a.

Has anyone tried talking to the NOC?

> /ol

-derek

-- 
Derek Atkins
Principal Software Engineer

PGP Corporation
4 Farragut Ave
Somerville, MA  02144

+1 617 623 3745 | [email-masked]

PGP Corporation -- Rest Secured.(TM)

PGP Fingerprint:
0FEE 5EA1 FF22 E0C9 4FFE
631A 9232 FF93 1C80 1DB7

This email and any attachments thereto may contain private,
confidential, and privileged material for the sole use of the intended
recipient. Any review, copying, or distribution of this email (or any
attachments thereto) by others is strictly prohibited. If you are not
the intended recipient, please contact the sender immediately and
permanently delete the original and any copies of this email and any
attachments thereto.

---

From: Thierry Ernst <[email-masked]>
Date: Tue, 24 Jul 2007 17:23:53 +0200

On Tue, 24 Jul 2007 08:08:45 -0700

>Anyone having trouble acquiring a network address over 802.11?  We had massive trouble yesterday in Monroe, and today I'm having trouble in Red Laquer. I can connect to ietf, ietf-a, ietf.1x, and ie…

Got the last one. I'm selling it on eBay ;-)
Thierry.

-- 
The coming end of the IPv4 world: http://penrose.uk6x.com

---

From: Keith Mitchell <[email-masked]>
Date: Tue, 24 Jul 2007 07:26:18 -0400

> It took a few minutes to get an v4 address in Monroe just now.

I've had major problems in Monroe - significant DHCP delays, and I can't
get 802.1x to work at all :-( Is this the correct wpa_supplicant config:

network={
       ssid="ietf-a.1x"
       key_mgmt=IEEE8021X
       eap=PEAP
       phase2="auth=MSCHAPV2"
       identity="ietf"
       password="ietf"
}

?

Keith  (sitting about 1m from an AP)

---

From: "Don Fedyk" <[email-masked]>
Date: Tue, 24 Jul 2007 11:58:37 -0400

I've been having trouble with DHCP as well. What worked for me was
repairing the connection with Windows. Just disabling and enabling the
connection did not work.  I don't know if that was just luck but the
repair operation reported the status as it was progressing and while
DHCP was slow it worked.  

Don  

-----Original Message-----
From: Derek Atkins [mailto:[email-masked]] 
Sent: Tuesday, July 24, 2007 11:20 AM
To: [email-masked]
Subject: Re: [69ATTENDEES] DHCP

>> Anyone having trouble acquiring a network address over 802.11?  We
had

-derek

PGP Corporation
4 Farragut Ave
Somerville, MA  02144

PGP Fingerprint:
0FEE 5EA1 FF22 E0C9 4FFE
631A 9232 FF93 1C80 1DB7

---

From: Roland Bless <[email-masked]>
Date: Tue, 24 Jul 2007 18:02:00 +0200

Hi,

Eric Burger wrote:
> had massive trouble yesterday in Monroe, and today I'm having trouble
> in Red Laquer. I can connect to ietf, ietf-a, ietf.1x, and ietf-a.1x,
> but I cannot acquire an address. Yes, IPv4.

Yes, I also had several problems this morning:
- first I was in the Crystal ballroom and had good 802.11g connectivity.
  After some time I was kicked out and lost association. I was not able
  to reconnect to an AP. I tried even different WLAN cards in order to
  exclude any driver/device problems. No luck.
- I moved to Red Lacquer and could associate with an AP, but
  got only an IPv6 address. After 20min or so the DHCP server
  gave me an IP address. Unfortunately there is no IPv6 DNS server
  address. So even IPv6 connectivity is very limited then if you
  can't resolv via IPv6.
- BTW: anyone here with a working wpa_supplicant.conf entry
  for the ietf.1x network?

Regards,
 Roland

---

From: "Murray S. Kucherawy" <[email-masked]>
Date: Tue, 24 Jul 2007 09:12:24 -0700 (PDT)

On Tue, 24 Jul 2007, Eric Burger wrote:
> massive trouble yesterday in Monroe, and today I'm having trouble in Red 

I had to wait several minutes yesterday, but eventually DHCP did work.

---

From: Ted Seely <[email-masked]>
Date: Tue, 24 Jul 2007 12:16:00 -0400 (EDT)

> I cannot acquire an address. Yes, IPv4.

same here.  problem in red lacquer, and hotel lobby bar.

fwi

-ted

---

From: Roland Bless <[email-masked]>
Date: Tue, 24 Jul 2007 18:21:32 +0200

> get 802.1x to work at all :-( Is this the correct wpa_supplicant config:

I just had success - after a lot of trial and error - with the following
one:
network={
        key_mgmt=WPA-EAP
        eap=PEAP
        ssid="ietf.1x"
        identity="ietf"
        password="ietf"
        phase2="auth=MSCHAPV2"
}

Actually wpa_cli status should look like this:

Selected interface 'eth1'
bssid=00:19:a9:41:39:c1
ssid=ietf.1x
id=0
pairwise_cipher=CCMP
group_cipher=TKIP
key_mgmt=WPA2/IEEE 802.1X/EAP
wpa_state=COMPLETED
ip_address=130.129.xxx.yyy
Supplicant PAE state=AUTHENTICATED
suppPortStatus=Authorized
EAP state=SUCCESS
selectedMethod=25 (EAP-PEAP)
EAP TLS cipher=AES256-SHA
EAP-PEAPv0 Phase2 method=MSCHAPV2

Regards,
 Roland

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Tue, 24 Jul 2007 12:17:22 -0500

[people were complaining about delays in getting an IPv4 address over  
DHCP, CCing the v6ops list to make a point]

> 	good reason to use IPv6 entirely, as long as you have IPv6 DNS  

More specifically, stateless autoconfig seems to work a lot better  
than DHCP in this case: one router advertisement can provide a large  
number of clients with address and configuration information, while  
DHCP requires messages back and forth for each individual client. A  
good reason to make sure that it's possible to run IPv6 with all that  
that entails (= DNS resolver addresses) without the need to run  
DHCPv6 if running DHCPv6 isn't specifically desired.

---

From: Iljitsch van Beijnum <[email-masked]>
Date: Tue, 24 Jul 2007 12:22:11 -0500

On 24-jul-2007, at 11:02, Roland Bless wrote:

>   Unfortunately there is no IPv6 DNS server

Feel free to use 2001:1af8:2:5::2, let me know if it doesn't work.

Iljitsch

---

From: JORDI PALET MARTINEZ <[email-masked]>
Date: Tue, 24 Jul 2007 12:45:10 -0500

Fully agree.

I was absolutely unable to get DHCP working during more than two hours
yesterday afternoon, which is unacceptable in my opinion.

However I was able to use IPv6, manually configuring my own IPv6 DNS
resolver from my home network.

It will be really nice to make sure that we can progress with more
parameters available in the RA.

And by the way, unfortunately the DHCP issues are very very very very
frequent in many networks, not sure if its a protocol/design issue or just
not so good DHCP implementations, but it is the reality.

Regards,
Jordi

> De: Iljitsch van Beijnum <[email-masked]>
> Responder a: <[email-masked]>
> Fecha: Tue, 24 Jul 2007 12:17:22 -0500
> Para: Jun-ichiro itojun Hagino <[email-masked]>
> CC: IPv6 Operations <[email-masked]>, <[email-masked]>
> Asunto: Re: [69ATTENDEES] DHCP
>

---

From: [email-masked] (Jun-ichiro itojun Hagino)
Date: Wed, 25 Jul 2007 03:08:31 +0900 (JST)

now i see rogue RAs which advertise fec0:0:0:4::/64 and
	202:8281:1768:4::/64.  my guess is that this is from the same guy.

	we need L2 switch vendors to implement ways to prevent rogue RA/DHCPv6
	sources, just like ways to avoiding rogue DHCPv4 servers/relay agents.

itojun

---

From: Chan-Wah Ng <[email-masked]>
Date: Wed, 25 Jul 2007 02:20:45 +0800

I had problems with DHCP this morning in the state ballroom as well.  My
dhcpcd client would spurred out various "Error: received message
xid=balh-blah-blah that is not mine (xid=foo-bar)." and finally died
after time out.  Eventually, I do get a valid response after like 100
attempts.

/rgds
/cwng

---

From: Tim Chown <[email-masked]>
Date: Tue, 24 Jul 2007 19:30:38 +0100

> 	sources, just like ways to avoiding rogue DHCPv4 servers/relay agents.

Any comments on

http://www3.ietf.org/proceedings/07jul/slides/dhc-5.pdf

to the v6ops list would be welcome.   A couple of us will be converting
this material, which was assembled from talking to various admin type
people from enterprise networks, into an informational draft in the next 
couple of weeks.   The draft will include feedback received from dhc and 
v6ops WG meetings yesterday, and hopefully generate some discussion
towards 'bcp' type advice.

-- 
Tim

---

From: Rémi Denis-Courmont <[email-masked]>
Date: Tue, 24 Jul 2007 21:44:06 +0300

On Tuesday 24 July 2007 21:08:21 james woodyatt wrote:
> On Jul 24, 2007, at 12:17, Iljitsch van Beijnum wrote:
> > [...]  A good reason to make sure that it's possible to run IPv6
> > with all that that entails (= DNS resolver addresses) without the
> > need to run DHCPv6 if running DHCPv6 isn't specifically desired.
>
> dns-sd -Q _domain._udp.local SRV --> /etc/resolv.conf
>
> Quite a thrilling proposal from a security perspective, but it's
> worth contrasting with the idea of reserving a global IPv6 anycast
> address for DNS resolving proxy servers.

Or you could have kept the network configuration email from the NOC guy on 
this very same mailing, which nicely included the list of local recursive 
IPv6 DNS servers: 2001:df8:0:5::6 and ...::7

:P

-- 
Rémi Denis-Courmont

---

From: Randall Gellens <[email-masked]>
Date: Tue, 24 Jul 2007 11:49:52 -0700

This morning in the Grand Ballroom, and the first session after lunch 
in Salon, it took me more than 30 minutes to get an address.  (I 
actually got an address just before 1:00, but quickly lost it, and 
was unable to get one for another 30 minutes.)
-- 
Randall Gellens
Opinions are personal;    facts are suspect;    I speak for myself only
-------------- Randomly-selected tag: ---------------
In the beginning was the word...and it was the wrong length.
                 --Bob Barton (Burroughs computer architect)

---

From: Trond Skjesol <[email-masked]>
Date: Tue, 24 Jul 2007 21:03:40 +0200

> IPv6 DNS servers: 2001:df8:0:5::6 and ...::7
Yes, it's nice to get information but these DNS servers doesn't answer 
on IPv6?

  -Trond

---

From: james woodyatt <[email-masked]>
Date: Tue, 24 Jul 2007 14:05:11 -0500

> IPv6 DNS servers: 2001:df8:0:5::6 and ...::7

I shouldn't have tried to be subtle.  The idea I was trying to imply  
is that operating systems COULD be written to acquire the addresses  
of local DNS resolving proxy servers on networks where IPv6 routers  
advertise unmanaged prefixes by performing a multicast DNS query for  
the _domain._udp.local SRV record and resolving the associated  
hostnames for their AAAA records.

Observant participants may be aware that some consumer IPv6 router  
equipment already advertises these records for their integrated DNS  
proxy servers.  All that's missing is the appropriate code in your  
operating system to perform the query and plumb up the resulting  
addresses to the back end of the getaddrinfo() system function.

-- 
j h woodyatt <[email-masked]>

---

From: Tim Chown <[email-masked]>
Date: Tue, 24 Jul 2007 20:06:33 +0100

> Yes, it's nice to get information but these DNS servers doesn't answer 

If you have XP I think you can't do v6 DNS transport (without some local
proxy trickery).  Vista does though.

-- 
Tim

---

From: Roland Bless <[email-masked]>
Date: Tue, 24 Jul 2007 21:08:26 +0200

Hi Jordi,

> yesterday afternoon, which is unacceptable in my opinion.

Luckily there weren't such heavy DHCP problems in the past
few IETF meetings. However, we had them some time ago
and are obviously common.

> parameters available in the RA.

Yes, but host implementations must also be enable to make use
of such features...

> not so good DHCP implementations, but it is the reality.

I can second that. I guess it is indeed a problem of broadcasting,
per client request processing and packet loss. Stateless autoconfig
seems to be much more robust and efficient in these cases.

Regards,
 Roland

---

From: Tim Chown <[email-masked]>
Date: Tue, 24 Jul 2007 20:09:04 +0100

> hostnames for their AAAA records.

The draft specifcying how RA's can carry DNS resolver info has been 
approved as an experimental RFC.   I don't know if it has an RFC number
yet but the draft is here:

http://www.ietf.org/internet-drafts/draft-jeong-dnsop-ipv6-dns-discovery-12.txt

Whether anyone will implement it widely is another question...

-- 
Tim

---

From: Bill Fenner <[email-masked]>
Date: Tue, 24 Jul 2007 15:15:14 -0400

>DHCP requires messages back and forth for each individual client.

And one rogue advertisement can take out the same set of clients.
I don't see the advertisements active right now with tcpdump,
but it is still attached to my interface:

llama% ifconfig en1
en1: flags=8963<UP,BROADCAST,SMART,RUNNING,PROMISC,SIMPLEX,MULTICAST> mtu 1500
        inet6 fe80::219:e3ff:fe03:e7f1%en1 prefixlen 64 scopeid 0x5 
        inet6 fec0::7:219:e3ff:fe03:e7f1 prefixlen 64 autoconf 
        inet6 2002:8281:1768:7:219:e3ff:fe03:e7f1 prefixlen 64 autoconf 
        inet6 2001:df8::80:219:e3ff:fe03:e7f1 prefixlen 64 autoconf 
..

and for a while my default route was pointing to it.

Yes, a rogue DHCP server can wreak similar havoc, but for some reason
this particular failure mode seems quite common.

  Bill

[Based on the IPv4 address in the 6to4 address, this particular rogue
has MAC address 00:11:09:0e:34:2f and is using the b/g radio on an AP
in the Hilton executive lounge.]

---

From: Kurt Erik Lindqvist <[email-masked]>
Date: Tue, 24 Jul 2007 22:43:45 +0200

> Yes, but host implementations must also be enable to make use

It would be even better if there was even content I could access with  
or without those features...

- kurtis -

---

From: [email-masked] (Jun-ichiro itojun Hagino)
Date: Wed, 25 Jul 2007 07:20:42 +0900 (JST)

> http://www3.ietf.org/proceedings/07jul/slides/dhc-5.pdf

	just to be sure: i've commented to v6ops list.
	DHCPv6 is NOT a solution.

itojun