How are broadcast IP packets reaching my inet interface?

windowbreaker · 2009-03-10 03:39:14

I was inspecting my iptables log, and noticed a large amount of packets with a broadcast destination ip address (255.255.255.255). Here is a sample log entry:

Mar  9 20:21:10 router kernel: INPUT_OUTSIDE_DROP: IN=eth2 OUT= MAC=ff:ff:ff:ff:ff:ff:00:05:5e:3b:6b:81:08:00 SRC=172.16.4.1 DST=255.255.255.255 LEN=333 TOS=0x00 PREC=0x00 TTL=255 ID=12382 PROTO=UDP SPT=67 DPT=68 LEN=313

These were dropped of course, but how do they get past routers and to my external NIC? Are routers not supposed to block broadcast packets such as these.

My current theory is that these packets are originating at one of my ISP's other clients utilizing the same router as me. That black-hatter is specifying a broadcast MAC address and spoofing his IP hoping to get past a non-stateful firewall with a simple ruleset.

However, I'm curious as to what type of packet crafting can get this packet to route from the Internet all the way to my NIC. If any network guru's can enlighten me as to how these packets are reaching my NIC I'd appreciate it.

byte · 2009-03-10 17:44:41

> Are routers not supposed to block broadcast packets such as these.

"Supposed" is the keyword here.

fukawi2 · 2009-03-10 22:24:48

Is your LAN in the 172.16.4.x range?

windowbreaker · 2009-03-11 05:30:32

fukawi2 wrote:

Is your LAN in the 172.16.4.x range?

Nope. But the fact that the source address is a private LAN address is what makes me suspect that it's spoofed. That and the broadcast MAC address in the packet. This does not appear to be a packet a router would forward, leading me to believe that it's coming from someone behind the same ISP router which I am sitting behind.

But I'm curious as to others' opinions as to how this packet could be reaching my NIC.

cactus · 2009-03-11 06:59:42

that looks like a dhcp server discovery-reply packet. src port 68, dest port 67, to the broadcast ip.

if you are on a cable modem network (docsis), you will see alot of broadcast traffic from your local loop. Mostly from misconfigured devices, or from a computer that was on a private network but then plugged into the router (sending out dhcp discovery packets to try and renew an ip). It could also be someone who plugged in their linksys backwards (lulz) with their modem in bridge mode or something.

Last edited by cactus (2009-03-11 07:05:41)

toxygen · 2009-03-11 13:59:41

my router (d1-624) under tools -> misc has settings for discarding ping, multicast, and other random wan-side broadcasts (kind of like iptables i think), so there's probably a setting you need to change on your router.

Arch Linux

#1 2009-03-10 03:39:14

How are broadcast IP packets reaching my inet interface?

#2 2009-03-10 17:44:41

Re: How are broadcast IP packets reaching my inet interface?

#3 2009-03-10 22:24:48

Re: How are broadcast IP packets reaching my inet interface?

#4 2009-03-11 05:30:32

Re: How are broadcast IP packets reaching my inet interface?

#5 2009-03-11 06:59:42

Re: How are broadcast IP packets reaching my inet interface?

#6 2009-03-11 13:59:41

Re: How are broadcast IP packets reaching my inet interface?

Board footer