Help Interpreting System Log Message on EX3301

Griswold

I'm getting a lot of messages of the same type in my System Log, each relating to different ip addresses on my WLAN.

Here's a typical example, can anyone help with interpreting what is going on please?

Many thanks in advance.

tonygibbs16

You're welcome @Griswold

I think that it is because some device is asking. It might not be on your WiFi though, and unfortunately I cannot tell the maker of the device, because 26:42:01 is not a registered IEEE OUI (so it is probably a randomly generated one.)

If you are confident that you are using static addresses for all of your devices, then you could disable DHCP for LAN setup on your EX3301 router. See below screenshot from the user guide available at

Download Library | Zyxel Networks and

EX3301-T0_OPAL-Series (EX5601-T0)_UG_V5..pdf

.

Kind regards,

Tony

tonygibbs16

Hi @Griswold

Welcome to the forum.

The messages in the screenshot you have posted are related to your router giving out IP addresses to the devices on your WIFi by DHCP ( Dynamic Host Configuration Protocol), in this giving out 192.168.1.246

I hope that this is helpful.

Kind regards Tony

Griswold

Thanks Tony.

I wonder why the router is trying, and I assume given the error portion of the message failing, to give out ip addresses as I've assigned static ip addresses to all the devices on my network.

tonygibbs16

You're welcome @Griswold

I think that it is because some device is asking. It might not be on your WiFi though, and unfortunately I cannot tell the maker of the device, because 26:42:01 is not a registered IEEE OUI (so it is probably a randomly generated one.)

If you are confident that you are using static addresses for all of your devices, then you could disable DHCP for LAN setup on your EX3301 router. See below screenshot from the user guide available at

Download Library | Zyxel Networks and

EX3301-T0_OPAL-Series (EX5601-T0)_UG_V5..pdf

.

Kind regards,

Tony

Griswold

Thanks again Tony.

The device in my example is a Sky Q Box, but it wasn't the only device where this was happening. In fact it was pretty much every device on my WLAN, most of which are served via a TP Link 650 WiFi Extender.

Ethernet directly cabled devices were, obviously, not affected by this.

Disabling DHCP has certainly rectified the problem and there are now no such items in the System Log, though I'm still puzzled why the router would be trying to use DHCP when all devices have static addresses.

Thanks again for your help Tony, I'll mark your post was the solution.

Best Regards

Peter

Peter2

I configured or limited only a small range of 30 IP Adresses for DHCP in my home Network , devices with static IP Adresses are configurated with IP adresses outside . I have no dhcp errors DHCP devs accept sended Lease Messages and a static configured dev. causes no log entry . And is accepted without problems also after days over lease time .

Griswold

Thanks Peter.

After marking Tony's post as the solution I have discovered that a number of devices, (Myket Smart Switches), don't work with static IP addresses.

I have temporarily set everything to dynamic and am now getting lots of debug messages like these….

Peter2

… but what is happening if you only allow a limited range for allowed DHCP Adresses ?

tonygibbs16

Hi Peter @Griswold

I think that the messages in the log are ones generated as debug level messages for the normal operation of DHCPv4.

As they are at the debug level of priority, which is a low level of priority, you could ignore them unless you have problems that you need to look into in more detail.

One of messages is for a Ring Chime doorbell with a mac address that starts 9e:76:13

Another DHCPv4 message has a mac address that starts with c6:ce:F5 is not listed as an IEEE OUI but the message says that it is a Watch.

If you set the level on the System Log page to a level other than ALL or Debug then these messages will not be visible any more, but will still be in the log.

I hope that this is helpful.

Kind regards Tony

Peter2

In my way with a limted range for allowed IP adresses i had a dev that i could not config correct so i gave a static DHCP adress instead .

If in this environment are important security devs present may be you configure a second IP adress room to be calmed ? You can do this with this Router or a VPN capable switch .

Griswold

@tonygibbs16 Thanks again Tony. I guess I could just ignore these messages as the network is working just fine, but old habits die hard. Before retiring I worked in IT for over 40 years and I always had to get to the bottom of error and debug types of message.

The way I'd like the router to work is to email me when it knows it has a problem, but I don't want to be inundated with messages like these that I can't address.

And I still have the Ping Of Death Attack messages from my Ring Chime Pro going into my Security Log!

Maybe my router is haunted ;-)

Best Regards

Peter