BOOTP Packets from Internet?

22

Did another tcpdump for the specific source addresses:

19:26:19.545710 ARP, Request who-has 10.78.100.20 tell 10.78.64.1, length 46
19:26:19.921794 ARP, Request who-has 10.78.100.20 tell 10.78.64.1, length 46
19:26:22.226924 ARP, Request who-has 10.73.98.238 tell 10.73.96.1, length 46
19:26:23.226948 ARP, Request who-has 10.73.98.238 tell 10.73.96.1, length 46
19:26:23.227790 ARP, Request who-has 10.78.85.202 tell 10.78.64.1, length 46
19:26:24.227057 ARP, Request who-has 10.73.98.238 tell 10.73.96.1, length 46
19:26:24.227392 ARP, Request who-has 10.78.85.202 tell 10.78.64.1, length 46

Note: I am not using these 10.73.x.x or 10.78.x.x addresses on my local network. At least, I am unaware how or where I would be using those addresses.

23

Here’s a longer more verbose capture:
capture_file.txt.gz (13.5 KB)

24

Okay. That is what I guessed.
These packets belong to the private administrative network of your ISP.
Don’t know why these ARPs and DHCP replies are routed out of the modem.
In investigation of your problem, I noticed a weird situation. My IPFire does a DHCP request to renew the IP, but only replies for other systems in the DOCSIS net are received. :roll_eyes:

Your original log entries documented this strange behaviour only.

25

I’m assuming this is not a problem and I’m marking it solved.