When you referenced the ISP I do recall that when I obtain my IP from Time Warner / Road Runner that it is coming from the RFC1918 space.
I apologize for my idiocity. The other reply from fname lname (funny?) mentions this as well coming from Time Warner, although I have never called. It makes since (sorta) that they area always broadcasting. Thanks for all the quick replies! joey -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]]On Behalf Of Julian Church Sent: Wednesday, January 29, 2003 10:32 AM To: [EMAIL PROTECTED] Subject: Re: [leaf-user] tracing spoofed IPs? At 09:51 29/01/03 -0600, Joey Officer wrote: >Jan 29 11:23:47 firewall kernel: Packet log: input DENY eth0 PROTO=17 >10.51.192.1:67 255.255.255.255:68 L=350 S=0x00 I=25217 F=0x0000 T=255 (#8) What you have there is just "static" from your ISP, that you can safely put in silent deny. Your ISP's DHCP server is replying to an IP address request from one of their customers. At this stage in the IP lease negotiation, the recipient has no IP address, so broadcast addresses are required and consequently the packets turn up in lots of places they're not needed. Although it can seem odd to find to see packets bearing source addresses in this range on your external interface, it's not uncommon for ISP's to use RFC1918 IP's to host this kind of service. regards Julian -- [EMAIL PROTECTED] www.ljchurch.co.uk ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com ------------------------------------------------------------------------ leaf-user mailing list: [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html ------------------------------------------------------- This SF.NET email is sponsored by: SourceForge Enterprise Edition + IBM + LinuxWorld = Something 2 See! http://www.vasoftware.com ------------------------------------------------------------------------ leaf-user mailing list: [EMAIL PROTECTED] https://lists.sourceforge.net/lists/listinfo/leaf-user SR FAQ: http://leaf-project.org/pub/doc/docmanager/docid_1891.html
