Hello On 03.02.2012 09:20, RandallM wrote: > since no one could answer the last one how bout this. In my FW log > Trust (our 10.0.0.0. network) to untrust picked this up: > > 2012-02-02 10:08:10 7.254.254.254:68 7.254.254.255:67 0.0.0.0:0 > 0.0.0.0:0 DHCP 0 sec. 0 0 Traffic Denied > > My "any" to "any" denied queue.
Was there some notebook (or other device), which came out of this IP range (could also be from somewhere else where internally this IP range is misused), into your local network? This is a DHCP request from the client (from port 68) to the dhcp server or broadcast address (to port 67). Sometimes a dhcp client, which has just been (re-)connected to the network, tries to check if the last assigned IP address is still valid. As the assigned network parameters are still known, it is sending the message directed to the possible target. bye Fabian _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
