bootpd[1053]: Option 43: Client specified unacceptable option length (### octets)

[Jack C. Mahaffey]

This message has been appearing in syslog. Any idea what needs done to fix it? ### has been different integer values.


jack...

[Bill Hassell]

The bootp protocol is unaddressed so any bootp server will try to respond to any bootp request on the subnet (bootp packets are usually blocked at the router). If the MAC address is shown for this request, try to identify it from your switch information (assumes a managed switch) or look at the MAC manufacturer ID (the first few digits of the MAC address) and see what boxes have that type of NIC. The request is coming from some box on the network and it is invalid. If you don't use bootp, you can turn off the daemon and the messages will stop.

[Jack C. Mahaffey]

Thanks Bill

[Jack C. Mahaffey]

I'm not seeing any other bootp messages or MAC adresses with this message.

Does the integer next to bootp have any significance for tracking? The current example shows [1053].

[Bill Hassell · Accepted solution]

The [1053] is the bootpd process ID. Without a MAC address, you'll need a port monitor to find the culprit.

[Roland Piette]

Hi Jack,

Thanks to introduce this event. I get the same message in the syslog file on every server.

Hi Bill,

How is it possible to know who has send this request to the bootp protocol ? The line recorded in the syslog doesn't contain this information (neither IP nor MAC address) ! Because, I saw this event happens more than 120 times in a short timeframe on every server I think about a virus attack.

Regards,
Roland

[Stephen Keane]

One thing you can try is to retart bootpd with the debug flag set. Edit /etc/inetd.conf and add -d3 to the end of the line starting bootps. Then run inetd -c to redo the options. You might have to HUP the bootpd process too, I can't remember.

Option 43, BTW is the vendor specific information.

[Roland Piette]

Stephen,
Many thanks for this answer.
Option -c sends a SIGHUP to the process (man page).
I am waiting that this event come back to see in the syslog wich info I will receive with this debug mode.

Jack,
Can you give 8 points for Stephen.

Regards,
Roland