The local DHCP server on virtbr0 sends DHCP ACK messages when a VM is started and requests an IP address while the initial DHCP lease on the VM's MAC address hasn't expired. So, also pick the IP address of the VM if that type of message is seen. Thanks to Gerhard Stenzel for providing a test case for this. Signed-off-by: Stefan Berger <stefanb@us.ibm.com> Index: libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c =================================================================== --- libvirt-acl.orig/src/nwfilter/nwfilter_learnipaddr.c +++ libvirt-acl/src/nwfilter/nwfilter_learnipaddr.c @@ -98,6 +98,7 @@ struct dhcp { } ATTRIBUTE_PACKED; #define DHCP_MSGT_DHCPOFFER 2 +#define DHCP_MSGT_DHCPACK 5 struct ether_vlan_header { @@ -347,6 +348,7 @@ procDHCPOpts(struct dhcp *dhcp, int dhcp if (dhcp_opts_len >= 3) { uint8_t *val = (uint8_t *)&dhcpopt->value; switch (*val) { + case DHCP_MSGT_DHCPACK: case DHCP_MSGT_DHCPOFFER: *vmaddr = dhcp->yiaddr; *howDetected = DETECT_DHCP;