UDP Port 67 and 68 BootP Showing In Current Sessions

[daveywavey]

Has anyone seen this problem? I believe it is my ISP realaying DHCP. I checked to make sure that I have DHCP relay and Multicast forwarding disabled which they are. I have tried to create a custom IPS rule to block this traffic. But found out that it won' t work because of the order of operations of the unit (Packet reaches interface will match against routing table, then parse through FW policies, and the IPS.) Example this traffic shows in my current sessions area. 10.148.56.1 UDP Port 67 ------> UDP port 68 255.255.255.255 (External To Internal) I have sniffed this traffic and have more reason to believe it it DHCP, but to prove this theory I would like to block this traffic and see if it breaks my ability to access the net, if it does then I will know that it is needed. If not then problem solved. I think these links explain this issue a little more. http://www.linklogger.com/UDP67_68.htm http://www.tcpipguide.com/free/t_BOOTPClientServerMessagingandAddressing-2.htm Any suggestion on trying to block this traffic, would be greatly appreciated. Thanks, Davey

[#2]

I guess the question is do you have a dynamic Ip, is the firewall behind a router, since this is a dhcp broadcast from a private ip? There has been other disussions of this before. Some think they are not suppose to get these but a dynamic should always get a dhcp ack from there ISP I would think. anyway you should be able to drop this w/ firewall rule to wan address. Does this help?

[daveywavey]

Yes, I do have a dynamic IP, My Firewall is not behind a router. It goes from my cable box to my UTM. Can you point me to the past discussions, I was trying to find info on this and couldn' t. I tried dropping it with a FW policy, but it didn' t work. This was going to be my test, would I still have internet access or would it break as a result of blocking it. Something to make you think is, that looks like DHCP traffic but is it really and not someone doing something bad try to gather info on my device and or try to bypass my UTM.

[#4]

I dont think someone is doing something bad to you. This is a private IP so it appears and is only using dhcp udp protocols. If your worried about the IP call your ISP and ask. At present my firewall drops these broadcasts auto cause I have no policy allowing it thru. Me I dont worry about it. Everything is logged to a syslog server for review when needed.

[daveywavey]

So you have your UTM dropping this, so you have a static IP? Is there a way I can take my IP and place it in static routes as a work around?

[daveywavey]

I just tried to create a Null Interface and had the traffic dumped to this Null Interface by static policy route and it still shows in the Active Sessions. Man I don' t think there is anyway to stop it. Aside from turning off DHCP, that will solve this problem but then create a problem of not surfing the net!! Complete Security *lol*

[#7]

No I have a dynamic IP. I just dont really pay any attention to those form of broadcasts. But log everything for review. In therory it will not come thru firewall without a rule to allow, so internal dhcp is different. As for wan dhcp if this is how you get Ip than thats it. I have never allowed these thru the wan side and have never had a issue of dhcp renewal of public IP.

[daveywavey]

Thanks, lsmith You seem like a really are really knowledgeable. Just so I understand correctly, you have your external interface addressing mode set to DHCP? As I understand it, this traffic hits my external interface to tell my unit, here is your IP. The only thing is when I sniffed this traffic I could see other peoples PC' s responding with there name and IP' s. This is why I want to block it if possible. What do you mean you never allowed these thru? So you see this broadcast traffic on your current sessions, but you don' t have a FW policy allowing this traffic to continue to your internal side? Also, what do you use to filter through logs, for easier reviewing of logs. I currently use concatenate in Excel and then use a pivot table to better see what has happend. Any helpful scripts or apps? Thanks, Davey

[#9]

All I use is a syslog for log review. I have a trial of Fortireporter to check out but have not installed yet. So when you sniffed, you seen other public IP' S responding back that broadcast. If I understand than I am going to assume this is just the DHCP broadcast from your ISP' s DHCP server. Not @ home at the moment so I cant really say how I have mine set up.