dhcpd_eve+ ??

Hello,

Thanks for reaching out to Sophos Community.

Regret to hear about the issue you encountered. 

I may recommend you open a support case for this to be further investigated: https://support.sophos.com/support/s/?language=en_US#t=AllTab&sort=relevancy

Kindly share with us the caseID generated once you have it. 

Many thanks for your time and patience and thank you for choosing Sophos. 

Regards,

Thanks Raphael Alganes 

But what is this dhcpd_eve+ ??

Hello,

It should be dhcpd_events. If you would expand the terminal UI you should be able to see the whole text of dhcpd_eve+

Additionally, Sofos network  can you check Can you check if DHCP setting has low lease time or DHCP flooding seen ?

Hi Vivek Jagad 

lease time 1440 min

How to check if there is DHCP flooding ?

check for the drop-packet-capture for the port 67 or port 68 and look for the DoS category in the drop logs
> drop-packet-capture
> How to troubleshoot dropped packets

is't DHCP flooding ?

could be, try increasing your maximum lease time, you can set between 1-43200 mins...

could be, try increasing your maximum lease time, you can set between 1-43200 mins...

I changed it this morning to be 7 days

How to stop this?

does sophos xg86w have dhcp flood attack protection?

can Create a DoS bypass rule.

 ok, 
and I think that it is the firewall that is renewing the IP, 
since I disconnected the network cable from the PC concerned, but the firewall continues to renew the IP for the same PC
so Dos bupass rule can stop the renewing from FW?
Thanks & Regards,

but first need to validate if there is a flooding happening on the port 68,

ref:

Packet capture using KBA: https://support.sophos.com/support/s/article/KB-000037007?language=en_US

Collect the drop packet using KBA: https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/CommandLineHelp/DeviceConsole/index.html#drop-packet-capture

Hi Sofos network  It looks like there is a DHCP flood from a specific machine and it seems the network device is continuously producing lease requests because of a malfunction. After disconnecting the network cable of the concerned PC you may reboot the firewall once (at your most convenient time) which will clear pending DHCP operations and the CPU will be back to normal. Regarding the scenario of DHCP request flood, scaling or improving SF OS DHCP service handling with such DHCP flood is currently a backlog work at Product Management.