Serve different types of .efi boot files

[dureal99d]

@george1421 real computer a Samsung np300e5c

[george1421]

@dureal99d nuts, can you try another?

You can capture this with wireshark on a computer and not have to go the tcpdump route and then copy the file, etc. Any computer on the same subnet as the booting computer can detect these broadcast messages if you are running wireshark.

[dureal99d]

@george1421 said in Serve different types of .efi boot files:

can capture this with wireshark on a computer

sure

[dureal99d]

@george1421 wire shark capture. here ip address 192.168.1.121

[dureal99d]

@george1421 tcdump here of another machine Asus R503U

[george1421]

@dureal99d well on the first one I didn’t see any systems that transmitted their uuid in dhcp option 97. That sux a bit.

You might also want to learn about capture filters in wireshark. They are similar to the capture filters for tcpdump.

‘udp.port == 67 or udp.port == 68 or udp.port == 69 or udp.port == 4011’ this one is equiv to the tcpdump one we were using. Let me look at the ASUS computer.

[dureal99d]

@george1421 said in Serve different types of .efi boot files:

might also want to learn about capture filters in wireshark

for asus 00000011-0000-0000-0000-50465d986f3c / udp.port == 68

[george1421]

@dureal99d The asus one has something we can work with. That dhcp option 97 is ‘00000011-0000-0000-0000-50465d986f3c’

I can tell you if you boot this computer in bios mode (just for this test) you will probably see this listed on the initial pxe boot screen as GUID.

This number should also be visible in the /var/log/syslog or where ever dnsmasq is writing its log. In my testing the value from wireshark did not match up exactly with what was found in the dnsmasq log. You need the value that looks similar from the dnsmasq log. But with that information we can take the next step to create a match test.

[george1421]

@dureal99d said in Serve different types of .efi boot files:

@george1421 said in Serve different types of .efi boot files:

might also want to learn about capture filters in wireshark

for asus 00000011-0000-0000-0000-50465d986f3c / udp.port == 68

Bonus points for you!!

[dureal99d]

@george1421 said in Serve different types of .efi boot files:

You need the value that looks

ok

[george1421]

@dureal99d Which computer needs the special kernel the ASUS or Lenovo?

[dureal99d]

@george1421 they both like that intel1756.efi kernel

[george1421]

@dureal99d Like it enough to make that your default kernel and then the ones that don’t like it you make exceptions for? Use the 80/20 rule what do you have the most of on your campus and then make that your default kernel and the others be the exception.

[dureal99d]

@george1421 I have a lot of mixed clients, a good amount don’t mind the standard ipxe.efi. some are just a bit more diva like these 2

[dureal99d]

@george1421 this is what i see 00:11:00:00:00:00:00:00:00:00:00:50:46:5d...

[dureal99d]

@george1421 the entire readout

Oct 12 12:59:32 dureal99d-Precision-WorkStation-T5400 dnsmasq-dhcp[1280]: 3272245650 available DHCP subnet: 192.168.1.109/255.255.255.0
Oct 12 12:59:32 dureal99d-Precision-WorkStation-T5400 dnsmasq-dhcp[1280]: 3272245650 vendor class: PXEClient:Arch:00007:UNDI:003016
Oct 12 12:59:32 dureal99d-Precision-WorkStation-T5400 dnsmasq-dhcp[1280]: 3272245650 PXE(enp8s0) 50:46:5d:98:6f:3c proxy
Oct 12 12:59:32 dureal99d-Precision-WorkStation-T5400 dnsmasq-dhcp[1280]: 3272245650 tags: BC_UEFI, enp8s0
Oct 12 12:59:32 dureal99d-Precision-WorkStation-T5400 dnsmasq-dhcp[1280]: 3272245650 next server: 192.168.1.109
Oct 12 12:59:32 dureal99d-Precision-WorkStation-T5400 dnsmasq-dhcp[1280]: 3272245650 broadcast response
Oct 12 12:59:32 dureal99d-Precision-WorkStation-T5400 dnsmasq-dhcp[1280]: 3272245650 sent size:  1 option: 53 message-type  2
Oct 12 12:59:32 dureal99d-Precision-WorkStation-T5400 dnsmasq-dhcp[1280]: 3272245650 sent size:  4 option: 54 server-identifier  192.168.1.109
Oct 12 12:59:32 dureal99d-Precision-WorkStation-T5400 dnsmasq-dhcp[1280]: 3272245650 sent size:  9 option: 60 vendor-class  50:58:45:43:6c:69:65:6e:74
Oct 12 12:59:32 dureal99d-Precision-WorkStation-T5400 dnsmasq-dhcp[1280]: 3272245650 sent size: 17 option: 97 client-machine-id  00:11:00:00:00:00:00:00:00:00:00:50:46:5d...```

[Tom Elliott]

@dureal99d said in Serve different types of .efi boot files:

Oct 12 12:59:32 dureal99d-Precision-WorkStation-T5400 dnsmasq-dhcp[1280]: 3272245650 vendor class: PXEClient:Arch:00007:UNDI:003016

That is what I see:

[george1421]

@dureal99d Ok that is a bit what I saw when I was working on the tutorial at home. There has to be an easier way, I just haven’t learned it yet.

But here is what I did, I mashed the two values together.

# From wireshark.
00000011-0000-0000-0000-50465d986f3c
# Translated into 2 nibble hex numbers
00:00:00:11:00:00:00:00:00:00:50:46:5d:98:6f:3c

# From dnsmasq log
00:11:00:00:00:00:00:00:00:00:00:50:46:5d...

#Side by side aligned
   00:00:00:11:00:00:00:00:00:00:50:46:5d:98:6f:3c
00:11:00:00:00:00:00:00:00:00:00:50:46:5d...

#Missing bits filled into the dnsmasq one
00:11:00:00:00:00:00:00:00:00:00:50:46:5d:98:6f:3c

End results to create the unique uuid for this asus computer. 00:11:00:00:00:00:00:00:00:00:00:50:46:5d:98:6f:3c

So now we need to make one of those magical dnsmasq filters that will identify this computer for us.

Edit (duh, I just realized that the 50:46:5d:98:6f:3c of that uuid is the mac address of that computer. That won’t do for us exactly. but we are close)

[dureal99d]

@george1421 I see

[george1421]

@dureal99d This one may be harder than with the Dell computers I’ve tested on. The uuid is actually made up of two parts the IAID which should indicate the model and DUID which should should be device specific. In this case the model identifier is ‘00:11:00:00:00:00:00:00:00’ We can filter on that, but it doesn’t look too unique.