Full Disclosure mailing list archives
Re: can you answer this?
From: Fabian Wenk <fabian () wenks ch>
Date: Fri, 03 Feb 2012 17:57:58 +0100
Hello On 03.02.2012 09:20, RandallM wrote:
since no one could answer the last one how bout this. In my FW log Trust (our 10.0.0.0. network) to untrust picked this up: 2012-02-02 10:08:10 7.254.254.254:68 7.254.254.255:67 0.0.0.0:0 0.0.0.0:0 DHCP 0 sec. 0 0 Traffic Denied My "any" to "any" denied queue.
Was there some notebook (or other device), which came out of this IP range (could also be from somewhere else where internally this IP range is misused), into your local network? This is a DHCP request from the client (from port 68) to the dhcp server or broadcast address (to port 67). Sometimes a dhcp client, which has just been (re-)connected to the network, tries to check if the last assigned IP address is still valid. As the assigned network parameters are still known, it is sending the message directed to the possible target. bye Fabian _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- can you answer this? RandallM (Feb 03)
- Re: can you answer this? Fabian Wenk (Feb 03)
- Re: can you answer this? Full Disclosure mailing list (Feb 03)
- Re: can you answer this? Granville Moore (Feb 05)
- Re: can you answer this? Fatherlaptop (Feb 05)
- Re: can you answer this? Granville Moore (Feb 05)
- <Possible follow-ups>
- Re: can you answer this? james (Feb 03)
- Re: can you answer this? Zach C. (Feb 03)
- Re: can you answer this? Fatherlaptop (Feb 05)
- Re: can you answer this? Valdis . Kletnieks (Feb 05)
- Re: can you answer this? doomxd () gmail com (Feb 03)
- Re: can you answer this? doc mombasa (Feb 04)