Re: [logs] strange udp packets

From: Eric Mauricio (ericmaubrat_private)
Date: Tue May 28 2002 - 10:47:21 PDT

  • Next message: Luke Cats: "[logs] SonicWall firewall log Question...."

    This happens when you uses DHCP.
    Thatīs the "conversation" between you client machine
    that has requested an IP and the server answering the
    request.
    
    [],
     ericmau
    
    --- "Bernhardi, Brett" <brett.bernhardiat_private>
    wrote:
    > -----BEGIN PGP SIGNED MESSAGE-----
    > Hash: SHA1
    > 
    > 
    > 	I've been getting these packets every couple of
    > minutes or so,
    > 	and was wondering if someone could explain what is
    > going on to me.
    > 	eth0 is my internet-connected interface, with a
    > 66.66.x.y address.
    > 	24.92.226.16 is syrcnydhcp03-hme0.nyroc.rr.com.
    > 	I have no idea what isrrip1bw1.bin is.
    > 
    > 	thanks in advance for any help..
    > 
    > 	this is what showed up in my log file:
    > 
    > May 22 11:07:01 opiate kernel: IN=eth0 OUT=
    > MAC=ff:ff:ff:ff:ff:ff:00:b0:64:b7:93:54:08:00
    > SRC=10.108.112.1
    > DST=255.255.255.255 LEN=346 TOS=0x00 PREC=0x00
    > TTL=255 ID=62260
    > PROTO=UDP SPT=67 DPT=68 LEN=326
    > 
    > May 22 11:08:05 opiate kernel: IN=eth0 OUT=
    > MAC=ff:ff:ff:ff:ff:ff:00:b0:64:b7:93:54:08:00
    > SRC=10.108.112.1
    > DST=255.255.255.255 LEN=346 TOS=0x00 PREC=0x00
    > TTL=255 ID=62324
    > PROTO=UDP SPT=67 DPT=68 LEN=326
    > 
    > May 22 11:09:09 opiate kernel: IN=eth0 OUT=
    > MAC=ff:ff:ff:ff:ff:ff:00:b0:64:b7:93:54:08:00
    > SRC=10.108.112.1
    > DST=255.255.255.255 LEN=346 TOS=0x00 PREC=0x00
    > TTL=255 ID=62365
    > PROTO=UDP SPT=67 DPT=68 LEN=326
    > 
    > 	
    > 	this is the tcpdump output:
    > 
    > 11:07:01.335182 B 10.108.112.1.bootps >
    > 255.255.255.255.bootpc:
    > xid:0x88143c7e Y:10.108.121.141 S:24.92.226.16
    > G:10.108.112.1 ether
    > 0:80:37:ba:2:8b file "isrrip1bw1.bin" vend-rfc1048
    > T53:2 T54:283270168
    > T51:3593013504 SM:255.255.240.0 TZ:3234332671
    > DG:10.108.112.1
    > TS:24.92.226.16 LOG:0.0.0.0
    > T67:29545,29298,28777,25137,12663,25134,28265 (ttl
    > 255, id 62260)
    > 
    > 11:08:05.340916 B 10.108.112.1.bootps >
    > 255.255.255.255.bootpc:
    > xid:0xbffaf9e4 Y:10.108.121.141 S:24.92.226.16
    > G:10.108.112.1 ether
    > 0:80:37:ba:2:8b file "isrrip1bw1.bin" vend-rfc1048
    > T53:2 T54:283270168
    > T51:2502494464 SM:255.255.240.0 TZ:3234332671
    > DG:10.108.112.1
    > TS:24.92.226.16 LOG:0.0.0.0
    > T67:29545,29298,28777,25137,12663,25134,28265 (ttl
    > 255, id 62324)
    > 
    > 11:09:09.366036 B 10.108.112.1.bootps >
    > 255.255.255.255.bootpc:
    > xid:0x2baeaa3a Y:10.108.121.141 S:24.92.226.16
    > G:10.108.112.1 ether
    > 0:80:37:ba:2:8b file "isrrip1bw1.bin" vend-rfc1048
    > T53:2 T54:283270168
    > T51:1428752640 SM:255.255.240.0 TZ:3234332671
    > DG:10.108.112.1
    > TS:24.92.226.16 LOG:0.0.0.0
    > T67:29545,29298,28777,25137,12663,25134,28265 (ttl
    > 255, id 62365)
    > 
    > 
    > 
    > -----BEGIN PGP SIGNATURE-----
    > Version: PGPfreeware 6.0.2i
    > Comment: You hear maniacal laughter in the
    > distance...
    > 
    >
    iQA/AwUBPOu9+uB3FYbaQXHDEQJq+wCgzs+VGwwKcPmy5ZkqtXGXDsaIaw4AoNvv
    > +OSE1KI6XKo8vv7JuUCXC7R6
    > =DZE2
    > -----END PGP SIGNATURE-----
    > 
    >
    ---------------------------------------------------------------------
    > To unsubscribe, e-mail:
    > loganalysis-unsubscribeat_private
    > For additional commands, e-mail:
    > loganalysis-helpat_private
    > 
    
    
    =====
    "Accurate measurement is the begining of all wisdom."
                               - Imhotep c.a. 2650 B.C.
    
    __________________________________________________
    Do You Yahoo!?
    Yahoo! - Official partner of 2002 FIFA World Cup
    http://fifaworldcup.yahoo.com
    
    ---------------------------------------------------------------------
    To unsubscribe, e-mail: loganalysis-unsubscribeat_private
    For additional commands, e-mail: loganalysis-helpat_private
    



    This archive was generated by hypermail 2b30 : Tue May 28 2002 - 11:37:33 PDT