portsentry log

PcHammer · 01-22-2003, 04:35 AM

I'm geting this portsentry logs on my firewall pc:
portsentry[186]: attackalert: Connect from host: 0.0.0.0/0.0.0.0 to UDP port: 67

I can not find out witch pc is doing this, is there any way to find this out ??? The time interval is around 5min. I think it is a pc trying to get ip from dhcp server but i'm not sure if this.
If any one has any idea pls let me know.

regards , pchammer

DavidPhillips · 01-22-2003, 05:31 AM

for dhcp to work the client sends out a broadcast looking for a server. This is normal.

PcHammer · 01-25-2003, 11:42 AM

That is ok if they are looking for a DHCP server but I don't use dhcp so i need to determine witch MAC address it uses.

regards, pchammer

Darin · 01-25-2003, 12:19 PM

tcpdump when it's happening, you should see the ARP broadcast with the source MAC.