[RndTbl] Shaw DHCP weirdness or attack?

Sean Walberg sean at ertw.com
Wed Dec 5 13:02:08 CST 2012


On Wed, Dec 5, 2012 at 12:31 PM, Trevor Cordes <trevor at tecnopolis.ca> wrote:


> Hmm, I'm not sure I follow... been up too long!  Not sure why Shaw's
> routers would relay bc's across subnets sourced from random nitwit's
> broken client/router?  This is type "Boot Reply (2)" which should be
> coming from the DHCP server back to the client?


I'd be interested to see the packet.

At least with ARPs you see all sorts of subnet leakage. Do a "tcpdump arp"
some day and watch for stuff that doesn't belong, most of it comes from
Shaw routers.

Sean

-- 
Sean Walberg <sean at ertw.com>    http://ertw.com/
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://www.muug.mb.ca/pipermail/roundtable/attachments/20121205/ddc91104/attachment.html>


More information about the Roundtable mailing list