DHCP question. Is this an attack or legitimate
Hi
Have a single FC2 box - only 1 nic, so not acting as a router. Connected to cable modem and ip assigned fine. In my /var/log/messages I saw the following: Jun 17 13:21:41 mybox dhclient: DHCPREQUEST on eth0 to 62.2--.x.x port 67 Jun 17 13:21:41 mybox dhclient: DHCPACK from 62.2--.x.x Jun 17 13:21:41 mybox dhclient: bound to (my ip address) -- renewal in 32753 seconds. I've blocked out the ip address because I don't know if this is legitimate or not. I've not seen this before with my old RH7.3 box connected to the same cable modem. So this might be a FC2 thing. Is this my linux box trying to renew a lease (which is what I interpret this as) or is this someone trying to get a lease off me. If it's the latter - why and what danger is there? Firewall is running - stealthed according to grc.com - so shouldn't be offering a dhcp service to the outside world. Thanks |
Re: DHCP question. Is this an attack or legitimate
Everything's fine. Note how it says dhclient?
Your box sends out a request to the DHCP server: Jun 17 13:21:41 mybox dhclient: DHCPREQUEST on eth0 to 62.2--.x.x port 67 Server says ok, use the IP you requested: Jun 17 13:21:41 mybox dhclient: DHCPACK from 62.2--.x.x Interface is bound to the IP: Jun 17 13:21:41 mybox dhclient: bound to (my ip address) -- renewal in 32753 seconds. |
Thanks
Panic mode off...... |
All times are GMT -5. The time now is 09:31 PM. |