View previous topic :: View next topic |
Author |
Message |
manywele l33t
Joined: 12 Jul 2003 Posts: 743 Location: Inside
|
Posted: Mon Dec 22, 2003 8:11 am Post subject: Why is this 10.x.x.x address hitting port 68? |
|
|
Can any networking gurus explain to me what's going on here?
I'm in a house with 4 people. We have cable that goes to a modem and then to a switch and we get 4 public IP addresses. If I traceroute to my friend (who is in the house) it passes through 10.184.80.1 and then gets to him. When I look at my firewall logs I see this same address hitting port 68 every couple of minutes.
What is this address and why is it hitting port 68 every couple of minutes?
What is port 68? /etc/services says it is BOOTP client and google isn't very forthcoming on the subject of what this is. |
|
Back to top |
|
|
dice Guru
Joined: 21 Apr 2002 Posts: 577
|
Posted: Mon Dec 22, 2003 9:24 am Post subject: |
|
|
BOOTP was the predacessor to DHCP, they use the same port. That 10net address is probably some box belonging to your ISP, back when I used to have Sprint I always used to see these ICMPs from 10net addresses hitting my firewall (I'd blocked all incoming traffic from RFC 1918 addresses), took me a while to figure out that was the mysterious invisible server that was two hops out from my firewall.
If you're DHCPing your addresses I'd use tcpdump or ethereal to take a look at that traffic and figure out if it's trying to update lease times on your DHCP address or something. |
|
Back to top |
|
|
|