How are broadcast IP packets reaching my inet interface?

I was inspecting my iptables log, and noticed a large amount of packets with a broadcast destination ip address (255.255.255.255). Here is a sample log entry:
Mar 9 20:21:10 router kernel: INPUT_OUTSIDE_DROP: IN=eth2 OUT= MAC=ff:ff:ff:ff:ff:ff:00:05:5e:3b:6b:81:08:00 SRC=172.16.4.1 DST=255.255.255.255 LEN=333 TOS=0x00 PREC=0x00 TTL=255 ID=12382 PROTO=UDP SPT=67 DPT=68 LEN=313
These were dropped of course, but how do they get past routers and to my external NIC? Are routers not supposed to block broadcast packets such as these.
My current theory is that these packets are originating at one of my ISP's other clients utilizing the same router as me. That black-hatter is specifying a broadcast MAC address and spoofing his IP hoping to get past a non-stateful firewall with a simple ruleset.
However, I'm curious as to what type of packet crafting can get this packet to route from the Internet all the way to my NIC. If any network guru's can enlighten me as to how these packets are reaching my NIC I'd appreciate it.

that looks like a dhcp server discovery-reply packet. src port 68, dest port 67, to the broadcast ip.
if you are on a cable modem network (docsis), you will see alot of broadcast traffic from your local loop. Mostly from misconfigured devices, or from a computer that was on a private network but then plugged into the router (sending out dhcp discovery packets to try and renew an ip). It could also be someone who plugged in their linksys backwards (lulz) with their modem in bridge mode or something.
Last edited by cactus (2009-03-11 07:05:41)

Similar Messages

SSID=Broadcast Malformed Packet cause switch CPU increase 90 %

I have a Wirelles LAN composed of 4 WISM controllers mounted on 2 6513 catalyst . On the ACCESS switch I can see a lot of abnormal traffic that are in use in the port . After sniffing this traffic I have clear that was WIRELESS broacast traffic in particular : SSID=Broadcast Malformed Packet.
How to reduce this traffic ? I have to proceed in the WISM or just cut all the broacast strom over the switch ?
thank for any help

For that do disable the broadcast SSID. It may help you .

How cisco CSM parses packets?

Hi all, Some days ago i had a problem with a Cisco CSM configuration. The short history is that i had to change the parse-length (virtual server submode) command to the max. 4000 bytes value for this implementation to work, if i dont do this the CSM sends resets to the client. what i would like to know is if someone knows how the CSM parses packets when it is "searching" for a string,cookie,etc, i am having some difficulties finding info about this.

The parse length on the CSM is the amount of bytes we can store to find the needed information (ie: cookie).
So when we get an HTTP request or response the CSM will buffer everything it received up to max parse-len or header limit (\r\n\r\n).
Once we reached the end of the HTTP header we stop buffering.
While buffering we also start looking for the info that we need.
If we do find it we also stop buffering.
There is nothing magic here.
If the HTTP header gets so big that the info we are looking for goes beyond the max-parse-len when we start buffering looking for the info, we endup using all the buffer space allocated to the connection and decide to drop the connections as we don't know if the info is just not there, or somewhere further in the header but we don't have space to buffer more.
When the CSM was created a long time ago, 2000bytes for the header was normal.
Nowadays, http header tends to be bigger and it is very often require to bump the parse length even further than 4000 bytes.
This can be done with a variable.
Gilles.

How to Supress Hello packets on an interface enabled for OSPF

As I understand it, enabling an interface to join an area with the
NETWORK command, also causes Hello packets to be sent out the
interface. But if its a stub network, and you want it advertised, but
there is no need for Hello packets to be sent out the interface, how do
you suppress them?
The passive-interface command seems to be discouraged in OSPF, since
there is far more granular control over which interfaces are affected
by the network command.
The "redistribute connected subnets" could be used after entering the
network command with a very restrictive mask that advertises only
non-stub network interface(s). But that seems to open a whole new can
of redristribute issues.
This is simple to do, right?
Cheers

I don't why passive interface would be discouraged in OSPF--I've seen it used a lot in the networks I've worked on. In fact, with the advent of the passive-interface default command, it's much easier use passive interface in all the routing protocols.
The general rule of thumb is, if you want the routes to be internals, then use passive interface. If you want them to be externals, then use redistribute connected. You can filter the routes you pull in through redistribute connected using a route map. You can control which interfaces are pulled in through passive using the network statement.
Russ.W

FAQ: How are notifications made when a server is added to a cluster?

Hello,
          From the FAQ:
          Q: How are notifications made when a server is added to a cluster?
          A: The WebLogic Server cluster broadcasts the availability of a new
          server instance each time a new instance joins the cluster.
          Cluster-aware stubs also periodically update their list of available
          server instances.
          Does anybody know which interval is used for those Cluster-aware stubs?
          Regards,
          Merg


that's incorrect. It is not periodic. Anytime the server comes up it uses
          multicast to advertise its availability as well as the services it
          provides. When all the announcements are through you can get Cluster-aware
          stubs from that server as well.
          Cheers,
          -- Prasad
          Merg wrote:
          > Hello,
          >
          > From the FAQ:
          >
          > ----------
          > Q: How are notifications made when a server is added to a cluster?
          > A: The WebLogic Server cluster broadcasts the availability of a new
          > server instance each time a new instance joins the cluster.
          > Cluster-aware stubs also periodically update their list of available
          > server instances.
          >
          > ----------
          > Does anybody know which interval is used for those Cluster-aware stubs?
          >
          > Regards,
          > Merg
          Cheers
          - Prasad

How to Broadcast Control Query based on User Exit Variable

Hi Gurus,
How to Broadcast dashboard based on Control Query based on User Exit
Variable to different users via mail in BW 3.5 version. Any document or
steps to achieve this will be very helpful.
Regards
Vishwanath

Hi Surendra,
Thanks for the reply and your suggestion. It will be great if you can help me to answer the below:
1) What exactly we mean by Control Query - Any example will be very helpful
2) As you mentioned, yes the user exist to be written will be for user-exit variable for dynamic period selection - An Example on how to create this will be helpful
3) Once the above variable is created, what are the steps to include this variable in the Bex Query?
4) Once all the queries to be used in dashboard are implemented with the exit variable, how to create a variant to be used in Broadcasting?
5) How and where to configure the email recipients (to whom this dashboard will be sent via mail)?
6) How to set up the BW broadcaster in BW 3.5 using the control query ?( My question is though we have to send the dashboard to the users, which has multiple queries, how a single control query with variant will help us).
Awaiting your reply.
Thanks and Regards
Vishwanath

RE: How are you handlingDistributedAccessExceptions?

Hi,
It is a very interesting experiment!
About your question. I think it depends on how you code your transaction.
According to the manual, a transaction will rollback if an exception occurs
and is being handled outside that transaction. Thus, in your situation, if
the DistributedAccessException is being handled within the transaction, the
transaction isn't being rolled back yet! Therefore, when things resume
normal, you can continue.
Regards,
Peter Sham.
-----Original Message-----
From: Martin G Nystrom [SMTP:[email protected]]
Sent: Friday, March 12, 1999 11:37 PM
To: [email protected]
Subject: How are you handling DistributedAccessExceptions?
We have been experiencing network "gaps" where we get broadcast
storms and it
causes a temporary network loss for the end user. We use a pattern
whereby a
central client service object updates via remote "persistence"
service objects
to persist data.
I've done some testing by disconnecting my own network cable before
I try a
"save" (which commits the data to the persistence mgr). My custom
exception
handler catches the DistributedAccessException, and displays, "Sorry
the
network was down, try again". Then I reconnect the cable, dismiss
the
"network down" dialog, and find that the transaction completes on
its own.
I wonder... can I always be assured that the transaction will
complete once
the network is available again? When would a user need to try the
transaction
again?
-Martin
To unsubscribe, email '[email protected]' with
'unsubscribe forte-users' as the body of the message.
Searchable thread archive
<URL:http://pinehurst.sageit.com/listarchive/>
To unsubscribe, email '[email protected]' with
'unsubscribe forte-users' as the body of the message.
Searchable thread archive <URL:http://pinehurst.sageit.com/listarchive/>

Hi,
I have a different understanding, which is slightly different from yours and
the difference is on the last exception handling clause for the big
transaction. My understanding is, if I handle the exception before the "end
transaction" just like the way the exception is being handled in the middle
operation, the transaction will still commit. That's why, I usually handled
the exception outside the begin/end transaction block.
Maybe I should do some experiment on this new findings.
Peter Sham.
-----Original Message-----
From: [email protected] [SMTP:[email protected]]
Sent: Monday, March 15, 1999 11:46 AM
To: [email protected]; [email protected]
Subject: RE: How are you handling
DistributedAccessExceptions?
You can also put operations you dont want to blow the overriding
transaction inside their own exception blocks as long as you dont use the
"begin transaction" keyword..
i.e.,
begin transaction
doSomethingImportant(); // if this raises, we raise to
bottom of the big block and blow trans
begin
doSomethingLessImportant();
exception
when e : GenericException do
log the exception, clear error stack, etc..
If we hit here it will still do the next
step below in the big trans
end;
doAnotherImportantThing(); // exception here will also
raise out and blow transaction
exception
when e : ....
end transaction;
My understanding is that the middle operation is part of the
transaction, and if the third operation raises something and the transaction
rolls back the second operation rolls back also. By adding the mini
begin/exception/end block around the second operation you have simply
avoided blowing the transaction if the middle operation fails. Note that
you could also FORCE the transaction to fail if the error coming out of the
middle operation is severe enough-Just dont handle the raised exception or
re-raise something.
Hope this helps..
-Greg
> -----Original Message-----
> From: [email protected]
<mailto:[email protected]> [SMTP:[email protected]]
<mailto:[SMTP:[email protected]</a>]>
> Sent: Saturday, March 13, 1999 8:13 PM
> To: [email protected]
<mailto:[email protected]>
> Subject: RE: How are you handling
DistributedAccessExceptions?
>
>
>
>
> Forte rolls back the transaction before the exception
handler is invoked
> even if the exception is being handled inside the
transaction block. You
> should put the transaction block inside a loop and restart
the transaction
> if there is an exception or exit the loop if the
transaction completes
> successfuly.
>
>
>
>
>
>
> "Peter Sham (HTHK - Assistant Manager - Software
Development, IITB)"
> <[email protected] <mailto:[email protected]> > on 03/12/99
08:50:07 PM
>
> Please respond to "Peter Sham (HTHK - Assistant Manager -
Software
> Development, IITB)" <[email protected]
<mailto:[email protected]> >
>
> To: Martin G Nystrom <[email protected]
<mailto:[email protected]> >
> cc: [email protected]
<mailto:[email protected]> (bcc: Hetal Badheka/Blythe-Nelson)
> Subject: RE: How are you handling
DistributedAccessExceptions?
>
>
>
>
> Hi,
> It is a very interesting experiment!
> About your question. I think it depends on how you code
your transaction.
> According to the manual, a transaction will rollback if an
exception
> occurs
> and is being handled outside that transaction. Thus, in
your situation,
> if
> the DistributedAccessException is being handled within the
transaction,
> the
> transaction isn't being rolled back yet! Therefore, when
things resume
> normal, you can continue.
> Regards,
> Peter Sham.
> -----Original Message-----
> From: Martin G Nystrom
[SMTP:[email protected]] <mailto:[SMTP:[email protected]</a>]>
> Sent: Friday, March 12, 1999 11:37 PM
> To: [email protected]
<
"mailto:[email protected]">mailto:[email protected]>
> Subject: How are you handling
DistributedAccessExceptions?
> We have been experiencing network "gaps" where we get
broadcast
> storms and it
> causes a temporary network loss for the end user. We
use a pattern
> whereby a
> central client service object updates via remote
"persistence"
> service objects
> to persist data.
> I've done some testing by disconnecting my own
network cable before
> I try a
> "save" (which commits the data to the persistence
mgr). My custom
> exception
> handler catches the DistributedAccessException, and
displays, "Sorry
> the
> network was down, try again". Then I reconnect the
cable, dismiss
> the
> "network down" dialog, and find that the transaction
completes on
> its own.
> I wonder... can I always be assured that the
transaction will
> complete once
> the network is available again? When would a user
need to try the
> transaction
> again?
> -Martin
>
> -
> To unsubscribe, email '[email protected]' with
> 'unsubscribe forte-users' as the body of the message.
> Searchable thread archive
> <URL:http://pinehurst.sageit.com/listarchive/
<URL:http://pinehurst.sageit.com/listarchive/> >
> -
> To unsubscribe, email '[email protected]' with
> 'unsubscribe forte-users' as the body of the message.
> Searchable thread archive
<URL:http://pinehurst.sageit.com/listarchive/
<URL:http://pinehurst.sageit.com/listarchive/> >
>
>
>
>
>
>
> -
> To unsubscribe, email '[email protected]' with
> 'unsubscribe forte-users' as the body of the message.
> Searchable thread archive
<URL:http://pinehurst.sageit.com/listarchive/
<URL:http://pinehurst.sageit.com/listarchive/> >
To unsubscribe, email '[email protected]' with 'unsubscribe
forte-users' as the body of the message.
Searchable thread archive
<URL:http://pinehurst.sageit.com/listarchive/
<URL:http://pinehurst.sageit.com/listarchive/> >
To unsubscribe, email '[email protected]' with
'unsubscribe forte-users' as the body of the message.
Searchable thread archive <URL:http://pinehurst.sageit.com/listarchive/>

Broadcasting a packet to the echo post and listen for the replys

how to write code for broadcasting a packet to the echo post and listen for the replys ?

Not unusual to get charges, even receipts from the app store, a month later. I sometimes scratch my head trying to remember back to when I MADE that purchase

How are ePrint apps created and maintained?

Just bougt a new small HP printer for my home office and discovered ePrint and apps support. And amazed, did not expect this technology in entry level small/home office type printers.
And immediately new questions on what possibilities this opens up for printing applications
What is required to create new apps?
Is it possible to use this technology to add local office apps? I.e. to print site/office specific forms, trivial network interactions and maybe a bit more.
Is subscription type apps supported/allowed, where the app is only available as part of a third party subscription package?
A lot can be built around the email based ePrint service alone, but having ability to also do some simple interaction with the user at the printer would open for a wide range of new possible uses.

Hi,
Double post, please use:
http://h30434.www3.hp.com/t5/Printer-All-in-One-Install-Setup/How-are-ePrint-apps-created-and-mainta...
Regards.
BH
**Click the KUDOS thumb up on the left to say 'Thanks'**
Make it easier for other people to find solutions by marking a Reply 'Accept as Solution' if it solves your problem.

HT1933 How are you supposed to do this when it DOESN'T EVEN WORK!!!! you press report problem and it comes up saying " too many http redirects". Total useless !

How are you supposed to REPORT THE PROBLEM when it DOESN'T EVEN WORK!!
I clicked it as I got a receipt for something that HAS NOT EVEN BEEN BOUGHT ! (It's funny how apple try to charge me twice for something when I work nightshift and my phones switched off!)
and all that happened was it came up saying "too many HTTP redirects" .
And it won't let me report it ! X

Go here:
http://www.apple.com/support/itunes/contact/
and follow the instructions to report your issue to the iTunes Store.
Regards.

Hi there how are you guys out there of this forum? I got a question for y'a

Hi there how are you guys out there of this forum? I got a question for y’all
I wanted to know how I could record different folders using iTunes
Cause when recorded 2000 thongs on the DVD
There were 2000 songs to go through
So I really wanted to have had folders and then the music recorded inside them
So I could get right to where I wanted real quickly
Could anyone please teach me how to do that real quickly?
Can we do it with iTunes?
I know we can do it with Nero.

1) Go to file, select new playlist. Creat the playlaist.
2) Download your music into iTunes.
NOTE: CHECK 'Recently Added' before you download your music.
If the select boxes has a check in them, turn it off by
holding down the 'ctrl' key and selecting one of the
checked boxes. This shold turn off all the checks.
It would be better to clear 'Resently Add' of all
previous downloads, but I don't know how to do that
yet.
3) under 'PLAYLIST' on the right, select 'Recently Add'.
all of your song should show there with a check in the selection
box.
4)Hold the shift key and select the frist (selete records name),
then the last recorded tune. All of the recordings shouls light
up blue.
5) While holding the 'shift' key, drag one of the records to your new
playlist. All of the blue highlighted song will transfer to the new
playlist.

HT1202 I have just bought a new I pad 3 and want to give my I pad 2 to a friend. What will I have to do to clear my info on the old I pad and set it up on my new one? How are apple I D effected and passwords cleared?

I have just bought a new I pad 3 and want to give my I pad 2 to a friend. What will I have to do to clear my info on the old I pad and set it up on my new one? How are apple I D effected and passwords cleared?
Any advice welcome.

To clear to old before passing it on, open the Settings app and tap on General (left hand menu). Scroll down and tap on settings, then tap on Erase All Content and Settings.
If you have been synching the iPad to iTunes on a computer, you should also have backed it up. If you havn't backed it, you will want to do so before clearing the settings and use the back up to set up your new iPad.
You may dinf soem of the articles here useful:
http://www.apple.com/support/ipad/syncing/

What are Parameters? How are they differenet from Variables? Why can't we use variables for passing data from one sequnece to another? What is the advantage of using Parameters instead of Variables?

Hi All,
I am new to TestStand. Still in the process of learning it.
What are Parameters? How are they differenet from Variables? Why can't we use variables for passing data from one sequnece to another? What is the advantage of using Parameters instead of Variables?
Thanks in advance,
LaVIEWan
Solved!
Go to Solution.

Hi,
Using the Parameters is the correct method to pass data into and out of a sub sequence. You assign your data to be passed into or out of a Sequence when you are in the Edit Sequence Call dialog and in the Sequence Parameter list.
Regards
Ray Farmer

Hey how are you guys listen i have an iphone 4s the one i use with the H20 CARRIEr and i trying to enable the option call forwarding and when i type tho number i go back and i notice to the call forwarding it turning off as soon i back to the main menu ?

hey how are you guys listen i have an iphone 4s the one i use with the H20 CARRIEr and i trying to enable the option call forwarding and when i type tho number i go back and i notice to the call forwarding it turning off as soon i back to the main menu ?

There are a lot of posts in the forums today with people having problems with iMessage. There was also a published outage yesterday, so it's possible there are still some issues that may be impacting you both.
I would just wait it out - I'm sure it will be sorted out soon.

How are attribute and text master data tables linked in SAP R/3?

Hello,
how are attribute and text master data tables linked in SAP R/3?
Most tables with attribute master data like T001 for company codes,
have a text master data table T001T (add "T" to table name).
When looking at the content of table T001 via transaction se11,
the text are automatically joined.
But for some tables there is no "T"-table (e.g. table TVBUR for sales offices
has no text table TVBURT), but in se11 you get texts. There is an address
link in TVBUR, but the Name1, etc. are empty.
a) Where are the text stored?
b) How does the system know of the link?
Hope someone can help!
Best regards
Thomas

Hi Thomas
The master and text table are not linked by name, of course, if you see the text table, it has the same key fields of master table, only it has the field key spras and the field for description.
The link beetween the tables is done by foreign key: if you check the text table TVKBT u need to see how the foreign key for field VKBUR is done:
-> Foreing key with table TVBUR
-> Foreing key field type -> KEY FIELD FOR A TEXT TABLE
->Cardinality-> 1-:CN
It's very important the attribute sets for Foreing key field type, if it's KEY FIELD FOR A TEXT TABLE, it'll mean the table is a text table: i.e. that mean the master table is a check table for the text table, where the foreign key type is for text table.
U can find out the text table of master table by SE11: GoTo->Text Table
U can fined some information in table DD08L.
Max

How are broadcast IP packets reaching my inet interface?

Similar Messages

Maybe you are looking for