RE: Strange Packet logs in ipchains

["Mike Heitz" <mikeheitz () upshotmail com>]

Sam,

If I remember correctly, Windows machines that cannot find a DHCP server
(if configured to take their IP address from DHCP) will generate a
169.254.x.x address. I could be mistaken on that. If that's the case, it
sounds like a machine on your network that's having DHCP difficulties.

mike heitz ** sr it manager ** UPSHOT
312-943-0900 x5190

-----Original Message-----
From: Sam Dirk [mailto:samdirk () online ie] 
Sent: Tuesday, March 25, 2003 4:42 AM
To: security-basics () securityfocus com
Subject: Strange Packet logs in ipchains



Hi All,



Yesterday I noticed the following entry in logs:



Packet log: input REJECT eth0 PROTO=17 169.254.208.158:137 

169.254.255.255:137 L=96 S=0x00 I=3072 F=0x0

000 T=128 (#9)



This occured only on our internal (10.10.x.x address) network. The
packets 

were seen three times over the course of the day but lasted for only one
- 

two seconds so it was impossible to get a tcpdump.



In addition the source address was either 169.254.208.158 or 

169.254.24.111. We don't use the above addresses on the network so am I

-------------------------------------------------------------------
SurfControl E-mail Filter puts the brakes on spam,
viruses and malicious code. Safeguard your business
critical communications. Download a free 30-day trial:
http://www.surfcontrol.com/go/zsfsbl1


-------------------------------------------------------------------
SurfControl E-mail Filter puts the brakes on spam,
viruses and malicious code. Safeguard your business
critical communications. Download a free 30-day trial:
http://www.surfcontrol.com/go/zsfsbl1