DHCPINFORM

[Kim Ho]

In our HP-UX 11.00 server syslog.log file, there's a listing of the following:

Received DHCPINFORM creating DHCPACK. Request data: ci=0100053C049ED1, req IP not sent, ciaddr 192.168.1.100, giaddr 0.0.0, broadcast reply off, server id not sent.

Received DHCPINFORM creating DHCPACK. Request data: ci=0100053C049ED1, req IP not sent, ciaddr 169.254.118.141, giaddr 0.0.0, broadcast reply off, server id not sent

The system is not setup as a DHCP server. Any reason why the above message appears? Possibility of someone trying to hack the system?

[Biswajit Tripathy]

Since your system is creating a DHCPACK (atleast
that's what is logged in syslog), I would guess that the
DHCP server is running on your system. To confirm,
do the following:

1) See if bootpd process is running:
$ ps -ef | grep bootp

2) Make sure that the line starting with "bootps"
is commented in file /etc/inetd.conf

- Biswajit

[Kim Ho]

Hi Biswajit,

Yes, the bootpd process is running. I guess my question now is, if our server is not setup as a DHCP server, any reason why we wouldn't comment this out? Does this pose a security risk? This is the first time we ever saw the message in the syslog.log. And would we need to reboot the server if we do comment this out for it to take effect?

Thank you in advance for your help!

Kim

[Biswajit Tripathy]

Since the message "Received DHCPINFORM creating
DHCPACK..." is coming from DHCP server process,
it clear that the bootpd process is running. Since you
are not running DHCP server, you MUST comment
out the line starting with "bootps" in file /etc/inetd.conf
and then reconfigure your inetd by running
the following command :
$ inetd -c

- Biswajit

[Biswajit Tripathy]

Oops.. one more thing.

Kill the bootpd process after you reconfigure the
inetd.

- Biswajit

[Kim Ho]

Hi Biswajit,

Thank you for all your help. I'll comment out bootps on the inetd.conf file as well as kill the bootp process.

Thanks!

Kim