RE: Odd entries in my Security Router logs

From: Julian Young <julian.young(at)nl.compuware.com>
Date: Wed Dec 11 2002 - 03:53:54 EST

I think that drew schaffner was write when when he stated

> These look like normal bootp requests hitting your router. Do
> you happen to have actual pachet captures? Would there be any
> reason for a device (cable modem, cable router, etc) on the outside
> perimeter of your firewall to be requesting bootp service?

To which the answer is yes.

my guess is the when the fire wall was handeling the dhcp it we ere not picking these up. we were not login the dhcp traffic perhaps we should have done so.

what through me was the router claiming a DOS. what i don't understand is why i should be picking up this traffic since the target is xxx.254 i could understand it if it was .255

I could attempt to capture the packed. but since it's being blocked, it has to compete with other priorities i am afraid.

many thanks on and all

Julian

On Tue, 2002-12-10 at 18:17, Andrews, Jonathan (US - Hermitage) wrote:
> 192.168.0.0/16 is a privately addressed netblock. These packets could not

---

This list is provided by the SecurityFocus ARIS analyzer service. For more information on this free incident handling, management and tracking system please see: http://aris.securityfocus.com Received on Wed Dec 11 13:27:30 2002