Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

I have a Debian 7.1 machine that is our internal intrusion detection system running snort. It has started flaking on me and will pull a DHCP address even though I have it set to static. This happens every few hours.

Here is my /etc/network/interfaces

    # This file describes the network interfaces available on your system
    # and how to activate them. For more information, see interfaces(5).

    # The loopback network interface
    auto lo eth0 eth1
    iface lo inet loopback

    # The primary network interface
    allow-hotplug eth0
    iface eth0 inet static
            address 10.10.10.107
            netmask 255.255.255.0
            gateway 10.10.10.1

    iface eth1 inet manual
            up ifconfig $IFACE 0.0.0.0 up
            up ifconfig $IFACE promisc
            down ifconfig down
share|improve this question
1  
Can you check the Debian version you mention? If you really have a Debian 3.2 (and not a recent Debian with a 3.2 Linux kernel), I recommend you strongly to upgrade it. There is no longer any support for such old versions. As attacks change over time, it is important to have recent snort rules. –  jofel Jul 31 '13 at 13:47
    
@jofel There never even was a Debian 3.2 according to Wikipedia. After Sarge/3.1 came Etch/4.0. –  Michael Kjörling Jul 31 '13 at 13:53
    
@MichaelKjörling Yes, there was no official 3.2 release. But according to this thread Debian 3.2 was (at least some time) the version of Debian testing before Debian 4 was released. –  jofel Jul 31 '13 at 14:00
    
Oops, I guess that is kernel version. –  user44199 Jul 31 '13 at 17:32

1 Answer 1

There is probably network-manager or wicd running. Disable/Uninstall it. You can temporarily shutdown network-manager with service network-manager stop.

There could be also some dhclient programs in the background. Run

ps ax | grep  [d]hclient

or

pgrep dhclient

so check if there are DHCP clients running. You can kill them via killall dhclient.

Theoretically, there are other DHCP clients with different names, but it is unlikely that they are installed.

share|improve this answer
    
No network-manager or wicd installed. I killed dhclient so I will check on it at the end of the day and see if it has flaked on me again. Thanks. –  user44199 Jul 31 '13 at 13:39

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.