From owner-freebsd-questions  Sat Jul 28  8:39:54 2001
Delivered-To: freebsd-questions@freebsd.org
Received: from smtp-1.enteract.com (smtp-1.enteract.com [207.229.143.33])
	by hub.freebsd.org (Postfix) with ESMTP id BD70537B405
	for <freebsd-questions@freebsd.org>; Sat, 28 Jul 2001 08:39:50 -0700 (PDT)
	(envelope-from jtm63@enteract.com)
Received: from jamestown.21stcentury.net (24-148-57-120.na.21stcentury.net [24.148.57.120])
	by smtp-1.enteract.com (Postfix) with ESMTP
	id 3A3905ED5; Sat, 28 Jul 2001 10:37:59 -0500 (CDT)
Received: (from jtm@localhost)
	by jamestown.21stcentury.net (8.11.3/8.11.3) id f6SFbSo49881;
	Sat, 28 Jul 2001 10:37:29 -0500 (CDT)
	(envelope-from jtm63@enteract.com)
X-Authentication-Warning: jamestown.21stcentury.net: jtm set sender to jtm63@enteract.com using -f
To: David Kelly <dkelly@hiwaay.net>
Cc: freebsd-questions@freebsd.org
Subject: Re: dhclient: Odd errors - New exploit?
References: <200107280155.f6S1tDx67210@grumpy.dyndns.org>
From: James McNaughton <jtm63@enteract.com>
Date: 28 Jul 2001 10:37:27 -0500
In-Reply-To: <200107280155.f6S1tDx67210@grumpy.dyndns.org>
Message-ID: <86elr1qd3c.fsf@localhost.21stcentury.net>
Lines: 20
User-Agent: Gnus/5.0808 (Gnus v5.8.8) XEmacs/21.1 (Cuyahoga Valley)
MIME-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Sender: owner-freebsd-questions@FreeBSD.ORG
Precedence: bulk
List-ID: <freebsd-questions.FreeBSD.ORG>
List-Archive: <http://docs.freebsd.org/mail/> (Web Archive)
List-Help: <mailto:majordomo@FreeBSD.ORG?subject=help> (List Instructions)
List-Subscribe: <mailto:majordomo@FreeBSD.ORG?subject=subscribe%20freebsd-questions>
List-Unsubscribe: <mailto:majordomo@FreeBSD.ORG?subject=unsubscribe%20freebsd-questions>
X-Loop: FreeBSD.ORG

David Kelly <dkelly@hiwaay.net> writes:

> Do you happen to have a 3Com Sharkfin cable modem?

Yes

> 
> What you describe is what happens when the cable link is down when one 
> tries to renew the lease. The cable modem makes one of its own. Go 
> check /var/db/dhclient.leases and see if the 192.168.100 leases were 
> for 60 seconds?
> 

dhclient.leases only had the current (good) IP addresses listed so I
couldn't check that. However I feel much better knowing this is
related to the cable modem and not some sinister form of attack.

Thanks very much for the info.

Jim

To Unsubscribe: send mail to majordomo@FreeBSD.org
with "unsubscribe freebsd-questions" in the body of the message