bootpc traffic

[tonyolm]

I never saw this before.

One server has

255.255.255.255:bootps <=> *

when running iftop with data going back and forth.

15:31:29.539882 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0a:e6:fa:11:9e, length: 300
15:31:29.540756 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0a:e6:fa:11:9e, length: 300
15:31:29.543334 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0a:e6:fa:11:9e, length: 300
15:31:29.543431 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0a:e6:fa:11:9e, length: 300
15:31:29.544319 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0a:e6:fa:11:9e, length: 300
15:31:29.546883 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0a:e6:fa:11:9e, length: 300
15:31:29.546983 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0a:e6:fa:11:9e, length: 300
15:31:29.547848 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0a:e6:fa:11:9e, length: 300
15:31:29.550410 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0a:e6:fa:11:9e, length: 300
15:31:29.550506 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0a:e6:fa:11:9e, length: 300
15:31:29.551382 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0a:e6:fa:11:9e, length: 300
15:31:29.553927 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0a:e6:fa:11:9e, length: 300
15:31:29.554025 IP 0.0.0.0.bootpc > 255.255.255.255.bootps: BOOTP/DHCP, Request from 00:0a:e6:fa:11:9e, length: 300


Its continual.


Anyway to figure out what the mac address belongs to?

 

[atomicturtle]

That mac belongs to " 000AE6 Elitegroup Computer S"

you'd need to interrogate the switch to see what port that MAC is coming from. If you wanted to be evil you could also just throw a dhcp server up and give it an IP, and take a look at it with a port scanner.

 

[tonyolm]

Evil?

Moi?

Don't you know about karma and all

It's not my datacenter but a clients server. Everything is fine on the server except I saw the request traffic on iftop.

Iftop should be on everyones server.

 

[atomicturtle]

I believe its in the base channel on CentOS/RHEL and Fedora