Greetings LAine,
When you say "the vm", you mean the one running libreelec, that is trying to get and IP address, correct?
yes, you are correct.
I guess Broadcom.home is the IP of the VM that's running the dhcp server? (I should have suggested using "tcpdump -n -e -v" :-/)
frankly, I have no idea who is Broadcom.home. here is the requested dump: https://dpaste.com/849DMX9ND
It looks strange, but is normal. What usually happens is this:
1) The guest sends a DHCP Discover Request, suggesting that it would like to use the addres 10.0.0.40 (These details will be revealed once you add "-v" to your tcpdump commandline.
2) The DHCP server says to itself "Hmm, this guy wants to use 10.0.0.40, which is okay with me, but first I should see if someone else is using it", so it sends out an ARP request for 10.0.0.40. Then just to be sure, it sends another.
(at this point, if the server is dnsmasq and it hasn't received an ARP request, for some reason it sends an ICMP echo request to 10.0.0.40 (the requested/suggested IP) with destination MAC address of the client that just sent the DHCP request. No idea why. It won't be answered though (unless the client actually still had a lease on that address and was just renewing; but the DHCP server would know it if that's what was happening, so...)
3) If the server doesn't receive any response to the ARP request, then it will send a DHCP response to the requested IP + client MAC saying "Yes, you can use that IP address.
4) I'm not sure why (because it's been > 20 years since I last read the DHCP RFC), but in the case I just looked at on my host (which is using dnsmasq as the server, and dhclient as the client), the same request and response are sent/received at the same IP+MAC addresses a 2nd time.
5) at this point everybody agrees on the new IP address, the client sets its IP address, the server updates its leases table, and life carries on.
But to back up for a minute - it's completely normal for the DHCP server to send out an ARP request and get no response. I think things are going south sometime after that. Are you seeing a DHCP reply at all? If you don't see it on the libreelec (client) machine's tap device, check if you see it going *out* on the DHCP server's tap. If it's not there, then you'll need to debug inside the guest running the DHCP server.
Before this packet is receivd, the guest doesn't yet know that's its IP address, but it does know that's its MAC address, and it's waiting for a DHCP reply, so it takes the info from the reply, then sends another request, this time including all the options it received in the first reply.
4) Now
should I add another nic with static ip and try to trace the pkts from there?