LinuxQuestions.org
Download your favorite Linux distribution at LQ ISO.
Go Back   LinuxQuestions.org > Forums > Linux Forums > Linux - Newbie
User Name
Password
Linux - Newbie This Linux forum is for members that are new to Linux.
Just starting out and have a question? If it is not in the man pages or the how-to's this is the place!

Notices


Reply
  Search this Thread
Old 06-17-2004, 04:51 PM   #1
mazzo
Member
 
Registered: Jun 2003
Location: Thames Valley, UK
Distribution: RedHat from 5 -9, Fedora, Ubuntu, Centos 3 - 7, Puppy Linux
Posts: 140

Rep: Reputation: 15
DHCP question. Is this an attack or legitimate


Hi

Have a single FC2 box - only 1 nic, so not acting as a router.

Connected to cable modem and ip assigned fine.

In my /var/log/messages I saw the following:

Jun 17 13:21:41 mybox dhclient: DHCPREQUEST on eth0 to 62.2--.x.x port 67
Jun 17 13:21:41 mybox dhclient: DHCPACK from 62.2--.x.x
Jun 17 13:21:41 mybox dhclient: bound to (my ip address) -- renewal in 32753 seconds.

I've blocked out the ip address because I don't know if this is legitimate or not.

I've not seen this before with my old RH7.3 box connected to the same cable modem. So this might be a FC2 thing.

Is this my linux box trying to renew a lease (which is what I interpret this as) or is this someone trying to get a lease off me.

If it's the latter - why and what danger is there?

Firewall is running - stealthed according to grc.com - so shouldn't be offering a dhcp service to the outside world.

Thanks
 
Old 06-17-2004, 05:26 PM   #2
demian
Member
 
Registered: Apr 2001
Location: Bremen, Germany
Distribution: Debian
Posts: 303

Rep: Reputation: 30
Re: DHCP question. Is this an attack or legitimate

Everything's fine. Note how it says dhclient?

Your box sends out a request to the DHCP server:
Jun 17 13:21:41 mybox dhclient: DHCPREQUEST on eth0 to 62.2--.x.x port 67

Server says ok, use the IP you requested:
Jun 17 13:21:41 mybox dhclient: DHCPACK from 62.2--.x.x

Interface is bound to the IP:
Jun 17 13:21:41 mybox dhclient: bound to (my ip address) -- renewal in 32753 seconds.
 
Old 06-17-2004, 06:13 PM   #3
mazzo
Member
 
Registered: Jun 2003
Location: Thames Valley, UK
Distribution: RedHat from 5 -9, Fedora, Ubuntu, Centos 3 - 7, Puppy Linux
Posts: 140

Original Poster
Rep: Reputation: 15
Thanks

Panic mode off......
 
  


Reply


Thread Tools Search this Thread
Search this Thread:

Advanced Search

Posting Rules
You may not post new threads
You may not post replies
You may not post attachments
You may not edit your posts

BB code is On
Smilies are On
[IMG] code is Off
HTML code is Off



Similar Threads
Thread Thread Starter Forum Replies Last Post
Which codecs are legitimate on linux JacekZ Linux - Newbie 20 12-13-2005 09:28 PM
Question about dhcp houler Linux - Networking 9 04-06-2005 01:45 AM
looking for a legitimate copy of via voice for linux unixphreak Linux - Software 0 10-16-2004 11:34 AM
I have a legitimate post needed, but johnp LQ Suggestions & Feedback 8 05-02-2004 09:45 PM
land attack on DHCP kahpeetan Linux - Security 3 11-18-2003 11:41 AM


All times are GMT -5. The time now is 06:58 PM.

Main Menu
Advertisement
My LQ
Write for LQ
LinuxQuestions.org is looking for people interested in writing Editorials, Articles, Reviews, and more. If you'd like to contribute content, let us know.
Main Menu
Syndicate
RSS1  Latest Threads
RSS1  LQ News
Twitter: @linuxquestions
Facebook: linuxquestions Google+: linuxquestions
Open Source Consulting | Domain Registration