0.0.0.0 Broadcasts

Question

Level 1

10 points

0.0.0.0 Broadcasts

I am noticing an ongoing UDP deny notice from the bootp port from my xserve itself; however, it claims to be coming from IP address 0.0.0.0. It keeps sending this out over and over, despite the HW address that it is coming from (my server's en0) already having a manually assigned IP address. My co-workers are getting a bit annoyed by it as well, as it is filling up their firewall logs. Here's an example:

Sep 19 10:19:22 xserve1 ipfw[136]: 65534 Deny UDP 0.0.0.0:68 255.255.255.255:67 in via en0

Does anyone know what might be causing this? Any input would be appreciated.

xServe 2x2.8GHz Quad-Core Intel Xeon, Mac OS X (10.5.5)

Posted on Sep 19, 2008 8:03 AM

Reply

Answer 1

Camelot

Level 9

58,473 points

Sep 19, 2008 9:14 AM in response to James Kirkum

Ports 67 and 68 are used by bootp, the NetBoot service.

This sounds like some machine on your network is reaching out to find a NetBoot server it can boot from.

Are you sure they're sourced from your machine? From that log it says the traffic is coming in on en0, not going out from it.

Reply

Answer 2

Sep 21, 2008 1:07 AM in response to James Kirkum

Isn't that regular DHCP requests?

http://en.wikipedia.org/wiki/Bootstrap_Protocol

"Bootstrap Protocol, or BOOTP, is a UDP network protocol used by a network client to obtain its IP address automatically."

The bootpd is aslo used for the DHCP service in OS X

http://en.wikipedia.org/wiki/NetBoot

So if your server denies DHCP request coming in (some other device is doing DHCP?) you will keep seeing this in the logs if you use DHCP to assign IP numbers.

Must be the same for all the client computers if they are run with the firewall on (and logging denied packets).

(We usually don't bother with running firewalls on LAN client machines - OK if machines are laptops or running Windows, then it's probably a good idéa...)

I have seen logfiles filling up with DHCP requests on OS X server. It was from old Windows PCs when migrated into a virtual server. Something went wrong and they kept asking for days. Logfile was 50-60GB filling up the OS X boot disk.

Reply