General Questions

Unless you really know what you're doing, you probably shouldn't be using Promiscuous mode in VMware. I'm betting that is at least part of the problem. Promiscuous mode is typically only used to monitor/sniff network traffic.

I used this once when we had a network issue to allow Wireshark to analyze the traffic. It's remained enabled after that but I guess it's time to disable it. Although, I'm leaning to your idea - it's probably not promiscuous mode that causes the error.

I found a setting in the wireless controller - Broadcast Forwarding, which was set to enabled. I just set it to disabled and enabled multicast and it actually looks as though it doesn't flood the m0n0 now. Too soon to say for sure yet, but it looks good. Filesystem is at 89% and doesn't look like it's increasing. I'll post back when 24 hours have passed when I know if it's actually working for real.

I spoke too soon.

I actually managed to get multicast working in the network for about 6 weeks. All the iPads could use AirPrint, no problemo. Then all of a sudden everything went haywire again. Not entirely sure this actually is the multicast problem but the symptoms are exactly the same; The log displays the filesystem is full. And downloading the dhcpd.leases file shows it sure is full, it's spammed crazy with these lines:

lease 10.0.49.255 {
  starts 1 2013/02/25 12:10:32;
  ends 1 2013/02/25 14:10:32;
  binding state active;
  next binding state free;
  hardware ethernet c4:64:13:76:6d:30;
  uid "\001\304d\023vm0";
  client-hostname "APc464.1376.6d30";
}
lease 10.0.48.255 {
  starts 1 2013/02/25 12:10:32;
  ends 1 2013/02/25 14:10:32;
  binding state active;
  next binding state free;
  hardware ethernet c4:64:13:76:6d:3f;
  uid "\001\304d\023vm?";
  client-hostname "APc464.1376.6d3f";


It's the same MAC-addresses that keeps recurring about 150 - 200 times a second. These are Cisco 1141N wireless accesspoints, managed by a Cisco 2504 wireless controller. They're also basically the only thing that exists on the same network as m0n0wall, along with a few computers and a printer. The rest of the network is in seperate vlans.

I don't understand why these units would spam the dhcp server like this. Anyone got any ideas?

Would you be able to run Wireshark (or similar) to capture the DHCP traffic and see what is going on?

Or, possibly set up a separate DHCP server instead of m0n0wall and see if the issue persists?