DHCP question. Is this an attack or legitimate
 

Hi

Have a single FC2 box - only 1 nic, so not acting as a router.

Connected to cable modem and ip assigned fine.

In my /var/log/messages I saw the following:

Jun 17 13:21:41 mybox dhclient: DHCPREQUEST on eth0 to 62.2--.x.x port 67
Jun 17 13:21:41 mybox dhclient: DHCPACK from 62.2--.x.x
Jun 17 13:21:41 mybox dhclient: bound to (my ip address) -- renewal in 32753 seconds.

I've blocked out the ip address because I don't know if this is legitimate or not.

I've not seen this before with my old RH7.3 box connected to the same cable modem. So this might be a FC2 thing.

Is this my linux box trying to renew a lease (which is what I interpret this as) or is this someone trying to get a lease off me.

If it's the latter - why and what danger is there?

Firewall is running - stealthed according to grc.com - so shouldn't be offering a dhcp service to the outside world.

Thanks

Re: DHCP question. Is this an attack or legitimate
 

Everything's fine. Note how it says dhclient?

Your box sends out a request to the DHCP server:
Jun 17 13:21:41 mybox dhclient: DHCPREQUEST on eth0 to 62.2--.x.x port 67

Server says ok, use the IP you requested:
Jun 17 13:21:41 mybox dhclient: DHCPACK from 62.2--.x.x

Interface is bound to the IP:
Jun 17 13:21:41 mybox dhclient: bound to (my ip address) -- renewal in 32753 seconds.

Thanks

Panic mode off......