Help with firewall log

danimalz · 11-16-2008, 10:20 AM

My log files have a continual stream of connection attempts identical to this. Server is behind a firewall, and is (of course) itself firewalled. Any idea what this is?

Nov 16 08:07:58 server1 kernel: Connection attempt (UNPRIV): IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:19:5e:0b:92:af:08:00 SRC=169.254.1.86 DST=255.255.255.255 LEN=611 TOS=0x00 PREC=0x00 TTL=64 ID=7117 PROTO=UDP SPT=21302 DPT=21302 LEN=591

anomie · 11-16-2008, 10:26 AM

The source IP address is on link local address space.

My guess is there is a box on your network that is set up as a dhcp client. It is not getting an address issued by a dhcp server, so it gets assigned the address in 169.254/16 space that you see. Then it seems to be broadcasting packets to the whole subnet.

You might need to talk to your network staff and provide that information. They should be able to identify a switch / port where the traffic is coming from so that the offender can be pinpointed.