dhcp question

dividingbyzero · 10-02-2008, 06:19 AM

Hello.

Just wondering why If I log all in and outgoing traffic on my iptables I see DHCP coming in from isp but I don't see anything going back out from my computer? I thought that DHCP comes in from server on 67 to my port 68 (which I see logged) and then my machine sends back from 68 to the server on 67. Shouldn't I also see outbound traffic for DHCP from my comp to the dhcp server?

Thanks

pinniped · 10-02-2008, 07:37 AM

You should see the DHCP discovery broadcast and then the request, ACK, and any other transaction (set IP, DNS, routers, FQDN, etc).

dividingbyzero · 10-02-2008, 01:40 PM

Nope. All I see is a bunch of dhcp broadcasts from server to 255.255.255.255 and I don't see my machine respond although I allow everything on the output chain.

pinniped · 10-02-2008, 04:16 PM

I'm not familiar with what socket ports are meant to be used, but if the software continues its business on a different port then you won't log it. Try logging all packets; no other software should be sending packets at this stage anyway.

dividingbyzero · 10-02-2008, 09:30 PM

I think i got it after reading up on how dhcp works. The logs i see are coming from the DHCP server to 255.255.255.255, not to my computer's address. I think the whole DHCP handshake is being done before my firewall starts under Slackware and all i'm seeing are DHCP broadcasts.