O Debian altera aleatoriamente o endereço IP

Question

Eu tenho o debian6, as interfaces são configuradas manualmente:

eth0      Link encap:Ethernet  HWaddr 40:61:86:7c:42:ed
          inet addr:192.168.3.238  Bcast:192.168.3.255  Mask:255.255.255.0
          inet6 addr: fe80::4261:86ff:fe7c:42ed/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:25460712 errors:0 dropped:0 overruns:0 frame:0
          TX packets:15936414 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000
          RX bytes:20505323410 (19.0 GiB)  TX bytes:3909617144 (3.6 GiB)
          Interrupt:25

Esta máquina é usada como servidor DHCP (isc-dhcp-server) e forwarder DNS (bind9) e shorewall.

Recentemente e aleatoriamente, ele altera o endereço IP de eth0 para 192.168.0.1 ou até mesmo remove completamente as configurações de IP. Não consigo conectar a internet dessa máquina ou de qualquer outra máquina na rede local.

O que posso fazer para impedir esse comportamento? Como rastrear o serviço responsável por isso?

Conteúdo das interfaces

auto eth0
iface eth0 inet static
    address 192.168.3.238
    netmask 255.255.255.0
    gateway 192.168.3.1

auto eth1
iface eth1 inet static
    address 10.0.0.1
    netmask 255.0.0.0
    network 10.0.0.0
    broadcast 10.0.0.255

Relatório de syslog

Mar 15 10:44:22 debian avahi-daemon[2189]: Withdrawing address record for 192.168.3.238 on eth0.
Mar 15 10:44:22 debian avahi-daemon[2189]: Leaving mDNS multicast group on interface eth0.IPv4 with address 192.168.3.238.
Mar 15 10:44:22 debian avahi-daemon[2189]: Interface eth0.IPv4 no longer relevant for mDNS.
Mar 15 10:44:22 debian dhclient: DHCPDISCOVER on eth0 to 255.255.255.255 port 67 interval 4
Mar 15 10:44:22 debian kernel: [1107087.393431] martian source 10.0.40.1 from 10.0.40.167, on dev eth0
Mar 15 10:44:22 debian kernel: [1107087.393439] ll header: ff:ff:ff:ff:ff:ff:00:4f:67:03:b0:1f:08:06
Mar 15 10:44:22 debian kernel: [1107087.901047] martian source 10.0.40.1 from 10.0.40.185, on dev eth0
Mar 15 10:44:22 debian kernel: [1107087.901056] ll header: ff:ff:ff:ff:ff:ff:00:1e:58:0d:08:df:08:06
Mar 15 10:44:23 debian dhclient: Internet Systems Consortium DHCP Client 4.1.1-P1
Mar 15 10:44:23 debian dhclient: Copyright 2004-2010 Internet Systems Consortium.
Mar 15 10:44:23 debian dhclient: All rights reserved.
Mar 15 10:44:23 debian dhclient: For info, please visit https://www.isc.org/software/dhcp/
Mar 15 10:44:23 debian dhclient:
Mar 15 10:44:23 debian dhclient: /etc/dhcp/dhclient.conf line 19: no option named domain-nameserver in space dhcp
Mar 15 10:44:23 debian dhclient: supersede domain-nameserver 10.
Mar 15 10:44:23 debian dhclient:            ^
Mar 15 10:44:23 debian dhclient: /etc/dhcp/dhclient.conf line 20: semicolon expected.
Mar 15 10:44:23 debian dhclient: prepend
Mar 15 10:44:23 debian dhclient:  ^
Mar 15 10:44:23 debian dhclient: Listening on LPF/eth0/40:61:86:7c:42:ed
Mar 15 10:44:23 debian dhclient: Sending on   LPF/eth0/40:61:86:7c:42:ed
Mar 15 10:44:23 debian dhclient: Sending on   Socket/fallback
Mar 15 10:44:23 debian dhclient: DHCPRELEASE on eth0 to 192.168.0.1 port 67
Mar 15 10:44:23 debian dhclient: send_packet: Network is unreachable
Mar 15 10:44:23 debian dhclient: send_packet: please consult README file regarding broadcast address.
Mar 15 10:44:23 debian avahi-daemon[2189]: Interface eth0.IPv6 no longer relevant for mDNS.
Mar 15 10:44:23 debian avahi-daemon[2189]: Leaving mDNS multicast group on interface eth0.IPv6 with address fe80::4261:86ff:fe7c:42ed.
Mar 15 10:44:23 debian avahi-daemon[2189]: Withdrawing address record for fe80::4261:86ff:fe7c:42ed on eth0.
Mar 15 10:44:23 debian kernel: [1107088.283819] r8169 0000:02:00.0: eth0: link down
Mar 15 10:44:23 debian kernel: [1107088.283839] r8169 0000:02:00.0: eth0: link down
Mar 15 10:44:23 debian kernel: [1107088.284456] ADDRCONF(NETDEV_UP): eth0: link is not ready
Mar 15 10:44:23 debian dhclient: Internet Systems Consortium DHCP Client 4.1.1-P1
Mar 15 10:44:23 debian dhclient: Copyright 2004-2010 Internet Systems Consortium.
Mar 15 10:44:23 debian dhclient: All rights reserved.
Mar 15 10:44:23 debian dhclient: For info, please visit https://www.isc.org/software/dhcp/
Mar 15 10:44:23 debian dhclient:
Mar 15 10:44:23 debian dhclient: /etc/dhcp/dhclient.conf line 19: no option named domain-nameserver in space dhcp
Mar 15 10:44:23 debian dhclient: supersede domain-nameserver 10.
Mar 15 10:44:23 debian dhclient:            ^
Mar 15 10:44:23 debian dhclient: /etc/dhcp/dhclient.conf line 20: semicolon expected.
Mar 15 10:44:23 debian dhclient: prepend
Mar 15 10:44:23 debian dhclient:  ^
Mar 15 10:44:23 debian dhclient: Listening on LPF/eth0/40:61:86:7c:42:ed
Mar 15 10:44:23 debian dhclient: Sending on   LPF/eth0/40:61:86:7c:42:ed
Mar 15 10:44:23 debian dhclient: Sending on   Socket/fallback
Mar 15 10:44:23 debian dhclient: DHCPRELEASE on eth0 to 192.168.0.1 port 67
Mar 15 10:44:23 debian dhclient: send_packet: Network is unreachable
Mar 15 10:44:23 debian dhclient: send_packet: please consult README file regarding broadcast address.
Mar 15 10:44:23 debian kernel: [1107088.401716] r8169 0000:02:00.0: eth0: link down
Mar 15 10:44:23 debian kernel: [1107088.402152] ADDRCONF(NETDEV_UP): eth0: link is not ready
Mar 15 10:44:24 debian dhclient: Internet Systems Consortium DHCP Client 4.1.1-P1
Mar 15 10:44:24 debian dhclient: Copyright 2004-2010 Internet Systems Consortium.
Mar 15 10:44:24 debian dhclient: All rights reserved.
Mar 15 10:44:24 debian dhclient: For info, please visit https://www.isc.org/software/dhcp/
Mar 15 10:44:24 debian dhclient:

    

Answer 1

O que o seu syslog / dmesg diz? Uma mudança de endereço IP deve resultar em uma entrada no arquivo de log. Isso pode lhe dar uma dica do que a causou (ou seja, o par de linhas antes da alteração do IP).

Por exemplo, se você reinicia manualmente a rede, algo assim aparece no dmesg / syslog

[47460.471835] r8169 0000:09:00.0: eth0: link down
[47460.473570] r8169 0000:09:00.0: eth0: link down
[47460.475690] ADDRCONF(NETDEV_UP): eth0: link is not ready
[47463.368498] r8169 0000:09:00.0: eth0: link up
[47463.370603] ADDRCONF(NETDEV_CHANGE): eth0: link becomes ready

    

Answer 2

A pista do seu syslog é que você tem dhclient e avahi em execução. Para um servidor com configuração estática, é uma boa prática o apt-get remover o avahi-daemon e o network-manager. Você pode configurar o avahi para não interferir com a eth0, mas isso não vale a pena.

Depois de remover o avahi e o gerenciador de rede, reinicialize e execute ps ax para verificar se dhclient* e avahi* não estão em execução.