LinuxQuestions.org
Go Job Hunting at the LQ Job Marketplace
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Networking
User Name
Password
Linux - Networking This forum is for any issue related to networks or networking.
Routing, network cards, OSI, etc. Anything is fair game.

Notices

Reply
 
Search this Thread
Old 08-17-2008, 09:46 AM   #1
carves
LQ Newbie
 
Registered: Mar 2008
Posts: 3

Rep: Reputation: 0
What is this -> SRC=0.0.0.0 DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=128 ID


Hi Guys,

Firstly I apologize for not typing the correct subject since I myself dont know what would be the correct subject to put into.

Anyhow, I have this output from my iptables log;
Code:
SRC=0.0.0.0 DST=255.255.255.255 LEN=328 TOS=0x00 
PREC=0x00 TTL=128 ID=21050 PROTO=UDP SPT=68 
DPT=67
According to search that I have conducted, it is related to BOOTPS and BOOTPC and DHCP.

I would like very much to now how to shut the service down since I have checked my system and find that I dont run those services. Must have missed something.

PS. I'm running Fedora 4.

Thanks
 
Old 08-17-2008, 11:08 AM   #2
marozsas
Senior Member
 
Registered: Dec 2005
Location: Campinas/SP - Brazil
Distribution: SuSE, RHEL, Fedora, Ubuntu
Posts: 1,393
Blog Entries: 1

Rep: Reputation: 63
It is a broadcast message looking for some server which is serving boot by network.
Some devices may have its network card configured to get the initial boot from a server. With this you can have diskless devices, I mean, devices that doesn't have it own boot program/files.
 
Old 08-17-2008, 11:45 AM   #3
carves
LQ Newbie
 
Registered: Mar 2008
Posts: 3

Original Poster
Rep: Reputation: 0
Thanks for answering, that kind of help.

So what are my options here. I dont want this traffic filling up my log file.

Thanks
 
Old 08-17-2008, 01:11 PM   #4
marozsas
Senior Member
 
Registered: Dec 2005
Location: Campinas/SP - Brazil
Distribution: SuSE, RHEL, Fedora, Ubuntu
Posts: 1,393
Blog Entries: 1

Rep: Reputation: 63
I think you hou have two options:
1) Find the device and configure it to not boot by network.
2) Change your firewall configuration to not log broadcast packets.

both are tricky...may be not easy to find the devices or the device does not have an option to not send that broadcast message. Depending your firewall front end and your skils with iptables could not be easy to change your firewall configuration either.
 
Old 08-17-2008, 01:11 PM   #5
chort
Senior Member
 
Registered: Jul 2003
Location: Silicon Valley, USA
Distribution: OpenBSD 4.6, OS X 10.6.2, CentOS 4 & 5
Posts: 3,660

Rep: Reputation: 69
Put a netfilter rule in your firewall to block this specific traffic, without logging it. That would have to go above the current rule that logs everything that is blocked.
 
Old 08-17-2008, 09:26 PM   #6
carves
LQ Newbie
 
Registered: Mar 2008
Posts: 3

Original Poster
Rep: Reputation: 0
Thanks for the suggestions guys.

I will of course, firstly look for the devide that broadcast it and try to shut it down. And if that fails, I will do option 2.

Thanks.
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off


Similar Threads
Thread Thread Starter Forum Replies Last Post
Are Broadcasts to 255.255.255.255 Routed MQMan Linux - Networking 6 11-23-2005 02:16 PM
Logs full of hits to 255.255.255.255; how to stop logging? mac_phil Mandriva 2 02-23-2004 10:25 AM
dhcp subnet is 255.255.252.0 why does dhclient not find it???? baked Linux - Wireless Networking 0 01-06-2004 08:25 AM
UDP broadcast 255.255.255.255 java8964 Linux - Networking 0 10-29-2003 02:05 PM
configuring RH 7 for a subnet mask of 255.255.255.224 CDPL Linux - Networking 2 04-20-2002 09:06 AM


All times are GMT -5. The time now is 02:41 PM.

Main Menu
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
identi.ca: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration