Topics

1

20.1 Legacy Series / Unknown Log Entries

« on: April 29, 2020, 09:44:33 pm »

Hello,

Today while I was looking at some logs, I found some white entries with not much details to them. I've attached a screenshot. Can anybody enlighten me as to what these entries might be?

Thanks

2

19.1 Legacy Series / DHCP responses on WAN interface

« on: April 02, 2019, 10:15:50 am »

Hello,

I am a new user to OPNsense and I am trying to understand some log entries on my WAN interface. I'm getting DHCP OFFER and ACKNOWLEDGE packets on my WAN interface from my cable provider's DHCP server (10.80.212.53).

Code: [Select]

Interface Time Source Destination Proto Label
WAN Apr 2 03:51:36 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:51:36 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:51:16 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:51:11 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:51:05 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:51:02 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:51:00 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:50:55 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:50:55 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:50:55 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:50:46 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:50:42 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:50:42 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:50:40 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:50:37 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:50:33 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:50:21 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:49:55 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:49:53 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:49:49 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:49:49 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:49:32 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:49:09 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN
WAN Apr 2 03:49:06 10.80.212.53:67 255.255.255.255:68 udp Block private networks from WAN


I did a packet capture and viewed the data in Wireshark. What I noticed was that these OFFERs and ACKNOWLEDGEMENTS were responses to other user's (Cable Customers) DHCP DISCOVER and REQUEST messages and not mine. Each packet contains a different Client IP address and MAC address. I know that DHCP can communicate via Broadcast or Unicast. In this case, the responses from the server are being broadcasted back to the clients.

1) Is this normal to see on the WAN interface?
2) Is this traffic supposed to be allowed to the Firewall?
3) Why are the broadcasts only showing up from the server but I am not seeing client broadcasts for the DISCOVER messages?

If somebody could please help me out with these questions, it would be much appreciated.