Re: Port 18593 attacks

Generally your client keeps track of its last-used IP address, and reques=
ts
that again from the DHCP server.  Unless some other machine has already
received that IP address, the DHCP server will gladly give it to you agai=
n,
even if the previous lease has expired.



----- Original Message -----
From: "bbales" <[email protected]>
To: <[email protected]>
Sent: Tuesday, August 03, 2004 12:57 PM
Subject: [linux-help] Re: Port 18593 attacks


> On Monday 02 August 2004 17:58, you wrote:
> > Powering it off will release the IP;  But ONLY when the lease expires
> > and it does not get renewed.  Bruce said that, and I have experienced
> > it.
> >
> > Usually a lease gets renewed some (specified) time before it expires,=
 so
> > the modem will need to be powered off for at least the lease period i=
n
> > order to force the issuance of a new IP.
> >
> > On Fedora Core 2, pump has been removed and dhcp client is serviced b=
y
> > dhclient. Old lease info is kept in the dhclient.leases file.  Removi=
ng
> > or emptying that file may force assignment of a new lease without
> > waiting for the lease to expire.  I am unable to test because I do no=
t
> > use dhcp, but info dhclient has lots of information (including how to
> > explicitly release a lease).
> >
> > Also look at dhclient.conf file.
>
> The 12 hour power off didn't work.  Cox told me the lease was up at 5:5=
0
so I
> pulled the plug from 5:00 PM until 10:30 this morning.  Same IP address=
.
For
> two minutes I got hits on other ports - then the hits were all (or 96%)=
 to
> 18593.  Got 514 in 90 minutes.
>
> The owner of the lease is a Frazierwall box with a very limited Linux
system,
> so I doubt if it has dhclient.  I'm still investigating.
>
> John and Adam suggest releasing the lease and dropping another ethernet
board
> in.  I could do that if I knew how to release the lease.  The box has
dhcpcd,
> but no man page.
>
> As far as I can tell, this isn't hurting anything.  If Frazierwall didn=
't
send
> in a list of blocked connections I wouldn't have known it was happening=
.
But
> I'd still like to get it stopped.
> bruce
>
> -- This is the [email protected] list.  To unsubscribe,
> visit http://www.complete.org/cgi-bin/listargate-aclug.cgi
>
>

-- This is the [email protected] list.  To unsubscribe,
visit http://www.complete.org/cgi-bin/listargate-aclug.cgi