Re: [Full-disclosure] can you answer this?

[Fabian Wenk <fabian@xxxxxxxx>]

Hello

On 03.02.2012 09:20, RandallM wrote:
> since no one could answer the last one how bout this. In my FW log
> Trust (our 10.0.0.0. network) to untrust picked this up:
>
> 2012-02-02 10:08:10 7.254.254.254:68 7.254.254.255:67 0.0.0.0:0
> 0.0.0.0:0 DHCP 0 sec. 0 0 Traffic Denied
>
> My "any" to "any" denied queue.

Was there some notebook (or other device), which came out of this 
IP range (could also be from somewhere else where internally this 
IP range is misused), into your local network?

This is a DHCP request from the client (from port 68) to the dhcp 
server or broadcast address (to port 67). Sometimes a dhcp 
client, which has just been (re-)connected to the network, tries 
to check if the last assigned IP address is still valid. As the 
assigned network parameters are still known, it is sending the 
message directed to the possible target.


bye
Fabian

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/