I have a Debian 7.1 machine that is our internal intrusion detection system running snort. It has started flaking on me and will pull a DHCP address even though I have it set to static. This happens every few hours.

Here is my /etc/network/interfaces

    # This file describes the network interfaces available on your system
    # and how to activate them. For more information, see interfaces(5).

    # The loopback network interface
    auto lo eth0 eth1
    iface lo inet loopback

    # The primary network interface
    allow-hotplug eth0
    iface eth0 inet static

    iface eth1 inet manual
            up ifconfig $IFACE up
            up ifconfig $IFACE promisc
            down ifconfig down
  • 1
    Can you check the Debian version you mention? If you really have a Debian 3.2 (and not a recent Debian with a 3.2 Linux kernel), I recommend you strongly to upgrade it. There is no longer any support for such old versions. As attacks change over time, it is important to have recent snort rules. – jofel Jul 31 '13 at 13:47
  • @jofel There never even was a Debian 3.2 according to Wikipedia. After Sarge/3.1 came Etch/4.0. – a CVn Jul 31 '13 at 13:53
  • @MichaelKjörling Yes, there was no official 3.2 release. But according to this thread Debian 3.2 was (at least some time) the version of Debian testing before Debian 4 was released. – jofel Jul 31 '13 at 14:00
  • Oops, I guess that is kernel version. – user44199 Jul 31 '13 at 17:32

There is probably network-manager or wicd running. Disable/Uninstall it. You can temporarily shutdown network-manager with service network-manager stop.

There could be also some dhclient programs in the background. Run

ps ax | grep  [d]hclient


pgrep dhclient

so check if there are DHCP clients running. You can kill them via killall dhclient.

Theoretically, there are other DHCP clients with different names, but it is unlikely that they are installed.

  • 1
    No network-manager or wicd installed. I killed dhclient so I will check on it at the end of the day and see if it has flaked on me again. Thanks. – user44199 Jul 31 '13 at 13:39
  • The Network Manage can be used for other interfaces. Killing or removing it may be not a proper solution. – Dmitry Mar 28 '18 at 10:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy