Re: IP fw-in deny (?)

[Martin Schulze <joey@finlandia.Infodrom.North.DE>]

Ayres, Richard wrote:
> > kernel: IP fw-in deny eth0 UDP 192.168.4.1:68 255.255.255.255:67 L=328
> > S=0x00 I=53838 F=0x0000 T=128
> 
> Looks like DHCP.

Or BOOTP. 

finlandia:/var# grep bootp /etc/services
bootps          67/tcp                          # BOOTP server
bootps          67/udp
bootpc          68/tcp                          # BOOTP client
bootpc          68/udp

> > eth0 is the NIC to my cable modem, and 192.168.4.1 is the NIC to my
> > LAN.  The machine is an IPmasq firewall (and server in general).
> 
> I guess that somewhere on your LAN is a DHCP client and the firewall is
> attempting to route the DHCP requests out onto the internet, but getting
> stopped. It's a bit weird that you seem to be getting packets from
> '192.168.4.1' coming /in/ to eth0 rather than eth1, though.

One feature of DHCP is 'lease' which means that the client reconfigures
itself and re-sends DHCP queries.  Not that this would work with
windows but it sends packages.

Regards,

	Joey

-- 
Whenever you meet yourself you're in a time loop or in front of a mirror.

Please always Cc to me when replying to me on the lists.