This discussion has been locked.

You can no longer post new replies to this discussion. If you have a question you can start a new discussion

dhcpd_eve+ ??

Hi all

I have performance problems with the xg86w, the cpu sometimes reaches 100%
the top command gives the following result:
Thanks you.

This thread was automatically locked due to age.

Top Replies

Raphael Alganes 5 months ago in reply to Sofos network +2

Hello, It should be dhcpd_events . If you would expand the terminal UI you should be able to see the whole text of dhcpd_eve+

0 Sofos network 5 months ago in reply to Vivek Jagad

 ok, 
and I think that it is the firewall that is renewing the IP, 
since I disconnected the network cable from the PC concerned, but the firewall continues to renew the IP for the same PC
so Dos bupass rule can stop the renewing from FW?
Thanks & Regards,

0 Vivek Jagad 5 months ago in reply to Sofos network

but first need to validate if there is a flooding happening on the port 68,

ref:

Packet capture using KBA: https://support.sophos.com/support/s/article/KB-000037007?language=en_US

Collect the drop packet using KBA: https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/CommandLineHelp/DeviceConsole/index.html#drop-packet-capture

Thanks & Regards,
_______________________________________________________________

Vivek Jagad | Team Lead, Technical Support, Global Customer Experience

Log a Support Case | Sophos Service Guide
Best Practices – Support Case | Security Advisories
Compare Sophos next-gen Firewall | Fortune Favors the prepared
Sophos Community | Product Documentation | Sophos Techvids | SMS
If a post solves your question please use the 'Verify Answer' button.
Cancel
Vote Up 0 Vote Down

Cancel
0 Vishal_R 5 months ago in reply to Sofos network

Hi Sofos network It looks like there is a DHCP flood from a specific machine and it seems the network device is continuously producing lease requests because of a malfunction. After disconnecting the network cable of the concerned PC you may reboot the firewall once (at your most convenient time) which will clear pending DHCP operations and the CPU will be back to normal. Regarding the scenario of DHCP request flood, scaling or improving SF OS DHCP service handling with such DHCP flood is currently a backlog work at Product Management.

Regards,

Vishal Ranpariya
Technical Account Manager | Sophos Technical Support
Sophos Support Videos | Knowledge Base | @SophosSupport | Sign up for SMS Alerts |
If a post solves your question use the 'Verify Answer' link.
Cancel
Vote Up +1 Vote Down

Cancel