bootpd message in syslog

[Pauline Tran]

Hi All,

Recently I receive these following message in my /var/adm/syslog/syslog.log

Jul 22 08:15:54 hobbes bootpd[21674]: reading "/etc/bootptab"
Jul 22 08:15:54 hobbes bootpd[21674]: read 2 entries from "/etc/bootptab"
Jul 22 08:58:09 hobbes bootpd[21674]: Exiting after 15 minutes of inactivity
Jul 22 08:58:34 hobbes telnetd[20135]: Error checking child termination status:
error 4: Interrupted system call
Jul 22 08:58:44 hobbes bootpd[22348]: bootpd 2.4 #1.17.112.7: Wed Jul 30 01:28:3
6 GMT 1997

Please advice.
Thank you very much,
Pauline

[Jordan Bean]

Looks like you have the bootps service enabled in /etc/inetd.conf and something on your network is trying to boot from it. Do `man bootpd` to learn more about it. If hobbes is not a network boot server, then this service should be disabled. Perhaps calvin is just poking around.

[S.K. Chan · Accepted solution]

Are you suppose to run "bootpd" on this machine ? If you're not, just comment out the "bootpd" entry in /etc/inetd.conf and run "inetd -c" to re-read the file.
On the other hand if you need bootpd, these messages may not indicate any error. They are simply "operational logs" from the bootp daemon that fills up your syslog.log file. If that is the case I suggest you take a look at the system if it is loaded with the latest "bootpd(1M)/DHCP cumulative" patch. For example (on 11.00 PHNE_19241) if you look at the description of the patch, one of the symptoms in the list is "bootpd mesages filling up syslog.log". This may just be the solution to your problem.

[Pauline Tran]

Hello,

Do I need to do it (modify inetd.conf and run inetd -c ) in single user mode and reboot the server (HP-UX 9000, B.10.20, stand alone server)?
And if I want the network group find out which machine keep poking my server (they did but could not find which machine...), how can I help them?

Thank you very much,
Pauline

[steven Burgess_2]

Hi Pauline

You don't need to be in single user to modify inetd.conf file

Once you have run inetd -c you will see a reference to inetd re reading config file in your syslog

HTH

Steve

[Hai Nguyen_1]

Pauline,

You do not have to configure in single user mode.

As for finding a machine which tried to get this service from your server, it must be on the same subnet as your server. Hope this may help you narrow down the investigation. It might be an accident. For example, someone interrupted an autoboot from a box on the same subnet, searched for all bootable devices which also displayed your bootpd server, and happened to choose as a boot device to boot from.

Hai

Hai