full-disclosure - Re: can you answer this?

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]

Date: Fri, 03 Feb 2012 17:57:58 +0100
From: Fabian Wenk <fabian@...ks.ch>
To: full-disclosure@...ts.grok.org.uk
Subject: Re: can you answer this?

Hello

On 03.02.2012 09:20, RandallM wrote:
> since no one could answer the last one how bout this. In my FW log
> Trust (our 10.0.0.0. network) to untrust picked this up:
>
> 2012-02-02 10:08:10 7.254.254.254:68 7.254.254.255:67 0.0.0.0:0
> 0.0.0.0:0 DHCP 0 sec. 0 0 Traffic Denied
>
> My "any" to "any" denied queue.

Was there some notebook (or other device), which came out of this 
IP range (could also be from somewhere else where internally this 
IP range is misused), into your local network?

This is a DHCP request from the client (from port 68) to the dhcp 
server or broadcast address (to port 67). Sometimes a dhcp 
client, which has just been (re-)connected to the network, tries 
to check if the last assigned IP address is still valid. As the 
assigned network parameters are still known, it is sending the 
message directed to the possible target.

bye
Fabian

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/