AppleTV 3 floods DHCP when ethernet connected

DHCP requests from devices are sent to the broadcast address on that network range. Any device on the same wired network should see these packets. I don't think you need to setup port mirroring or router logs to see a device flooding requests for a DHCP lease. I may be wrong - I have a router that may be acting as dumb hub.

Terminal on a Mac on the same wired network…

ifconfig

…to see your interfaces list - work out which one is the ethernet on your Mac (it should be UP & have an IP address - compare it to your network settings if you are unsure).

Mine is 'en0' so in an admin account…

sudo  tcpdump -plenXX -i en0 -s 1500 port bootps or port bootpc

To confirm this is working, power off the ATV, unplug another device that is on ethernet & reconnect it - you should see the request for a lease.

Power up the ATV - now you should see a lot of traffic for the ATV if it it is flooding for leases.

If you see nothing at all - I may be an idiot, let me know 🙂

NOTES

You will not see the reply sent to devices from router - you need promiscuous mode for that.

You won't see requests for wifi connected devices either this is for ethernet testing.

@Mario MG, consider removing the port mirroring connection as a test - it may be part of your issue.

You can use a static address for the AppleTV without using static addresses for all 45+ devices. In our setup, we only use 2 static addresses, the router itself obviously & the AppleTV. Every other device uses DHCP. I just found that our setup works best that way. I have an ATV2.

Since the ATV3 has 2 interfaces (Ethernet & wifi) it will need 2 IP addresses, one for each interface.

To clarify -- I have our router setup to always assign 192.168.1.2 to the 12 digit wifi interface address of my ATV2. It is a reserved DHCP address and is never assigned to other devices requesting an address. The ATV2 is still set to DHCP, but it always gets the same address.

Have you considered that assigning the static IP might just be a useful test, can you try it to test? It may help others if it alters this behaviour, especially the ones who do not have 30 years of experience, the equipment or knowledge to test correctly.

You could assign the static address on the Apple TV via it's network settings, perhaps manual mode could make it stop asking for new leases provided you add the correct subnet mask etc. If possible it may be worth setting a fixed address on the wifi interface (or disable wifi if the ATV will allow it). I don't have an ATV, I'm just trying to think up possible solutions.

I understand this looks like a bug from the latest update & if that is the case it should be fixed, in the mean time figuring out a workaround may help with stability for other users.

I also recently found this and also found a solution that worked for me. In another post that I cannot find it was mentioned that you should check your wireless settings. When you are wired, your wireless settings are not visible. I unplugged my Ethernet and noted that I had a valid WiFi setup configured. I chose the option to forget the network and re-attached the Ethernet cable. I am only seeing normal DHCP activity now. The other thread mentioned that both networks would remain active and that this is an "IOS thing". Others have stated that switching to WiFi has worked for them, possibly for the same but reverse reason. Looks like IOS is happiest with only a single connection to your network.

Good luck 🙂

I don't see why they would add functionality to software releases yet not fix known (and documented) bugs...

A few things to keep in mind:

1) We don't know if they've been able to reproduce the issue. As I mentioned almost a year back, I have three 3rd gen ATVs, all hardwired, and none exhibit the bug. The DHCP implementation isn't brain dead but may have a bug in a particular set of circumstances. It might not even be that DHCP is the problem (see #3 below).

2) All bugs get prioritized and the reality, especially with a huge customer base, is some never rise to the point where they get fixed. As someone who has been in the trenches, I can see how other issues (including new features which promise added revenue) could take priority over this problem.

3) The one post a while back is interesting (Jan 12, 2016 from ElectronArt). If I'm reading it correctly, the link to the router or switch connected to the ATV is going down and back up again. In that is happening, it appears to be an Ethernet issue with maintaining the link and DHCP is actually doing the right thing in that case by requesting an IP address on each link up. The problem could be in the hardware at either end or the cable. It would be interesting to know if anyone else seeing this problem also sees the link up/down happening.

ifconfig may old, but it's just another bsd tool that is still built in. I've always hated networksetup, all of it's arguments are too long

networksetup -listnetworkserviceorder

networksetup -help

… 400 lines

networksetup -printcommands

…100 lines

😠 bleargh

ifconfig isn't editing anything here so ifconfig isn't terrible here is it?

@benji888,

To remove the router from the equation connect the ATV to your Mac via ethernet.

Enable internet sharing on the Macs ethernet port (you do not need an active internet connection, sharing still activates the OS X DHCP server).

Now tcpdump or use Wireshark on the ethernet (or the prettier CPA).

The ATV should flood the Mac's ethernet - if it doesn't there could be a different interaction on the router or network.

You don't need a days worth of logs, a few minutes of capture should show the ATV is malfunctioning.

1440x seems like a big number but you should probably examine how big those packets are, here is some more pre-coffee maths…

I get at the most 600bytes per request.

Gigabit ethernet carries upto 125,000,000bytes per second (probably more like 90,000,000 in my limited tests).

802.11.g WiFi networking is around 6,000,000bytes per second (or more like 3,000,000 in my limited tests). So even if you have old WiFi you still have many times the throughput that these packets require.

I can't see how 600bytes is a problem, it may be other issues that are causing network slowness mentioned here.

It seems like there is a bug here, however it is unlikely to cause issues on a home network as far as I can see.

Test my hypothesis if you like, I used…

sudo tcpdump -plenv -i en0 -s 1500 port bootps or port bootpc

To view the packet length & used https://en.wikipedia.org/wiki/Data_rate_units#Gigabit_per_second and https://en.wikipedia.org/wiki/List_of_device_bit_rates for the rates.

If you capture packets & look at how other devices behave they also send many DHCP requests, for example a test Mac Mini sends 2 requests per second during the boot picker phase (hold alt at startup). It may be annoying, but it could also be normal?

If we cannot help here please consider visiting an Apple store or posting feedback to Apple…

http://www.apple.com/feedback/appletv.html

More bug reports may increase the chance of a resolution.

I'm seeing similar behavior with the two ATVs that I have. The Ethernet port is toggling state roughly once per minute on one ATV and about half as often on the other ATV. Each time this happens the switch has to negotiate speed, perform STP check, update ARP and MAC tables, verify VLAN (port mobility), and then move on to the layer 3 stuff like DHCP. This behavior, the intervals in particular, don't make sense, something isn't right about the routine.

09:14:51 2016: 21:39 INTERFACE(6) Data: 1/29: link DOWN

09:14:53 2016: 21:41 INTERFACE(6) Data: 1/29: link UP

09:16:03 2016: 22:52 INTERFACE(6) Data: 1/29: link DOWN

09:16:06 2016: 22:54 INTERFACE(6) Data: 1/29: link UP

09:17:17 2016: 24:06 INTERFACE(6) Data: 1/29: link DOWN

09:17:19 2016: 24:08 INTERFACE(6) Data: 1/29: link UP

09:18:30 2016: 25:18 INTERFACE(6) Data: 1/29: link DOWN

09:18:32 2016: 25:21 INTERFACE(6) Data: 1/29: link UP

09:18:56 2016: 25:44 INTERFACE(6) Data: 1/29: link DOWN

09:18:58 2016: 25:46 INTERFACE(6) Data: 1/29: link UP

09:19:42 2016: 26:31 INTERFACE(6) Data: 1/29: link DOWN

09:19:45 2016: 26:33 INTERFACE(6) Data: 1/29: link UP

09:20:56 2016: 27:44 INTERFACE(6) Data: 1/29: link DOWN

09:20:58 2016: 27:47 INTERFACE(6) Data: 1/29: link UP

09:22:08 2016: 28:57 INTERFACE(6) Data: 1/29: link DOWN

09:22:10 2016: 28:59 INTERFACE(6) Data: 1/29: link UP

09:23:21 2016: 30:10 INTERFACE(6) Data: 1/29: link DOWN

09:23:23 2016: 30:12 INTERFACE(6) Data: 1/29: link UP

09:24:34 2016: 31:22 INTERFACE(6) Data: 1/29: link DOWN

09:24:36 2016: 31:25 INTERFACE(6) Data: 1/29: link UP

09:27:15 2016: 34:03 INTERFACE(6) Data: 1/29: link DOWN

09:27:17 2016: 34:05 INTERFACE(6) Data: 1/29: link UP

09:28:27 2016: 35:16 INTERFACE(6) Data: 1/29: link DOWN

09:28:30 2016: 35:18 INTERFACE(6) Data: 1/29: link UP

09:28:51 2016: 35:39 INTERFACE(6) Data: 1/29: link DOWN

09:28:53 2016: 35:41 INTERFACE(6) Data: 1/29: link UP

09:29:41 2016: 36:30 INTERFACE(6) Data: 1/29: link DOWN

09:29:43 2016: 36:32 INTERFACE(6) Data: 1/29: link UP

09:30:54 2016: 37:43 INTERFACE(6) Data: 1/29: link DOWN

09:30:56 2016: 37:45 INTERFACE(6) Data: 1/29: link UP

09:32:07 2016: 38:56 INTERFACE(6) Data: 1/29: link DOWN

09:32:09 2016: 38:58 INTERFACE(6) Data: 1/29: link UP

09:33:20 2016: 40:08 INTERFACE(6) Data: 1/29: link DOWN

09:33:22 2016: 40:10 INTERFACE(6) Data: 1/29: link UP

09:34:32 2016: 41:21 INTERFACE(6) Data: 1/29: link DOWN

Mario MG wrote:

FYI, Apple TV 4 does not have this problem. I have 2 3s, and 2 4s, only the 3s exhibit this problem. The ATV 4s are way better so once we replace the problem solved. Apple is not likely to fix this on the ATV 3.

Well, it's a software issue and Apple will continue to release software for the ATV2 and 3, if they want to generate revenue from legacy users (which tend to be the "early adopters" and "true believers" that you don't want to alienate).

I don't see why they would add functionality to software releases yet not fix known (and documented) bugs... Their brand's justification for the significantly higher prices (compared to the competition occupying the same market space) has always been "you get what you pay for".

Except when you don't.

Brian Cook4 wrote:

Once per minute is not a flood, if it was thousands of time per minute I would agree that is a flood and a major issue. Once a minute is nothing. If you put tcpdump on pretty much any device you will see a constant stream of seeming needless management traffic. I would guess it is related to supporting their screwed up Bonjour protocol but who knows. What ever the reason that is the way it works and it is not likely to change, and it is not hurting anything.

You're splitting hairs. The point is that it's not RFC conformant.

DHCP is a trivial protocol which has been around for a long time and it's well understood (I wrote RFC-1048 twenty-eight years ago).

There's no excuse for getting it wrong, especially not for a company the size of Apple with the resources to test this adequately and fix known (and widely reported) bugs.

Such behavior also doesn't scale well. What if you've got a DHCP server using an inefficient database representation (like a flat text file) which it has to open and read each time that it gets a request, and it's got hundreds of entries? Routers (especially CPE routers) tend to be budget boxes with a BOM of about $75 or less... and hence don't have a lot of cycles to spare beyond basic packet forwarding or filtering.

Having them do something 1440 times a day that they should be doing once a day or less is just plain broken anti-social behavior.

I Have a dedicated IP address on the LAN for my AppleTV 2. Have you tried that?

Thank you so much! You are absolutely correct. I was having a problem using Airplay from my Mac Mini (late 2012) to my ATV3 while both were connected by ethernet. I could get sound but only a grey screen on my TV. I tried everything I could think of to correct it, but nothing worked. I checked all the forums, but yours is the first solution I have seen. I changed the ATV3 to wifi and now everything is back the way it was.

My iPad and iPhone continued to have access to Airplay, only the Mini had problems.

What is the easiest way to open a case with Apple?

Don't they check their updates before they release them?