Security Incidents: Re: DHCP or Probe?

["Clint Bodungen" <clint () secureconsulting com>]

Friday, March 12, 2004 10:52 AM
Subject: Re: DHCP or Probe?


> I just wanted to respond as no one else has... perhaps it's just me and my
> somewhat limited understanding of cable network architecture, but if this
> is the cable modem renewing it's DHCP, it should not be sending the DHCP
> requests to the public IP on this user's computer.
>
> From what has been posted so far, it seems that this is a
> misconfiguration, but it is an interesting one. Anyone else have ideas?
My only assumption is this, and someone correct me if I'm wrong:  the modem
receives the DHCP packet and passes it on to my router.  My router sees the
original IP address of the 10. gateway/DHCP server because the cable modem
is basically acting like a router with an unnumbered interface.



---------------------------------------------------------------------------
Free 30-day trial: firewall with virus/spam protection, URL filtering, VPN,
wireless security

Protect your network against hackers, viruses, spam and other risks with Astaro
Security Linux, the comprehensive security solution that combines six
applications in one software solution for ease of use and lower total cost of
ownership.

Download your free trial at 
http://www.securityfocus.com/sponsor/Astaro_incidents_040301
----------------------------------------------------------------------------