Vít?z sout??e blast znám

[Tomas Tichy]

On Sat, Jan 31, 2004 at 06:13:21PM +0100, D.M. wrote:
> 
> já mám v logu firewallu tohle:
>       17:59:12.088745 rl0 @200:15 b 0.0.0.0,68 -> 255.255.255.255,67 PR udp len 20 328 IN
>       17:58:56.011091 rl0 @200:15 b 0.0.0.0,68 -> 255.255.255.255,67 PR udp len 20 328 IN
>       17:58:47.102037 rl0 @200:15 b 0.0.0.0,68 -> 255.255.255.255,67 PR udp len 20 328 IN
>       17:58:43.108202 rl0 @200:15 b 0.0.0.0,68 -> 255.255.255.255,67 PR udp len 20 328 IN
>       17:58:23.446108 rl0 @200:15 b 0.0.0.0,68 -> 255.255.255.255,67 PR udp len 20 328 IN
>       17:58:06.447319 rl0 @200:15 b 0.0.0.0,68 -> 255.255.255.255,67 PR udp len 20 328 IN
>       17:57:59.382973 rl0 @200:15 b 0.0.0.0,68 -> 255.255.255.255,67 PR udp len 20 328 IN
>       17:57:55.388161 rl0 @200:15 b 0.0.0.0,68 -> 255.255.255.255,67 PR udp len 20 328 IN
>       17:57:17.806095 rl0 @200:15 b 0.0.0.0,68 -> 255.255.255.255,67 PR udp len 20 328 IN
>       17:57:00.808861 rl0 @200:15 b 0.0.0.0,68 -> 255.255.255.255,67 PR udp len 20 328 IN
> 
> 
> ta zdrojová adresa 0.0.0.0 mi tedy není vůbec jasná (= každý počítač v síti?)

IP adresa 0.0.0.0 se pouziva jako pocatecni nastaveni sitoveho
interface. Ty zaznamy znamenaji, ze nejaky pocitac se pokouzi ziskat 
IPcko od nejakeho DHCP nebo BOOTP serveru (podle portu 68 -> na port 67) 
a pta se vsech - posila broadcast - adresa 255.255.255.255. 

Protoze tu mame IPcka pridelena staticky, tak se zrejme jedna o spatne 
nakonfigurovany pocitac. Router broadcasty by preposilat nemel, 
tedy tento pocitac je v Tve lokalni siti (domaci nebo je pripojeny 
na stejny AP).

napriklad z meho logu:
80 MAC=00:06:25:45:f4:9c SRC=192.168.131.171 DST=255.255.255.255 SPT=68 DPT=67
27 MAC=00:e0:98:b0:7e:ea SRC=0.0.0.0 DST=255.255.255.255 SPT=68 DPT=67
22 MAC=00:e0:98:b0:98:54 SRC=0.0.0.0 DST=255.255.255.255 SPT=68 DPT=67

a vypis z ARP tabulky (v linuxu zjistis pomoci arp -a, ve win nevim):
apkotrto.klfree.net (192.168.131.170)
aptomas.klfree.net (192.168.131.157) 
apnezamyslova.klfree.net (192.168.131.190)

Tom