Subject: [74attendees] Another rogue dhcp - To owner of mac address: 00:1b:63:e5:a2:53

From: Ondřej Surý <[email-masked]>
Date: Tue, 24 Mar 2009 17:25:03 -0700

Same applies for owner of 00:1b:63:e5:a2:53.

Could we please prepare blocking mechanisms for those people at least for
next ietf? I can handle those with iptables, but I feel it shouldn't
be necessary
at meeting like this...

Ondrej.

On Tue, Mar 24, 2009 at 9:19 AM, Ondřej Surý <[email-masked]> wrote:
> Could you please stop sending rogue DHCPs?
>
> Mar 24 09:12:50 ki dhclient: DHCPOFFER of 169.254.111.112 from 0.0.0.0
> Mar 24 09:12:50 ki dhclient: DHCPREQUEST of 169.254.111.112 on wlan0
> to 255.255.255.255 port 67
> Mar 24 09:12:50 ki dhclient: DHCPACK of 169.254.111.112 from 0.0.0.0
>
> Thank you,
> --
>  Ondrej Sury
>  technicky reditel/Chief Technical Officer
>  -----------------------------------------
>  CZ.NIC, z.s.p.o.  --  .cz domain registry
>  Americka 23,120 00 Praha 2,Czech Republic
>  mailto:[email-masked]  http://nic.cz/
>  sip:[email-masked] tel:+420.222745110
>  mob:+420.739013699     fax:+420.222745112
>  -----------------------------------------
>

-- 
 Ondrej Sury
 technicky reditel/Chief Technical Officer
 -----------------------------------------
 CZ.NIC, z.s.p.o.  --  .cz domain registry
 Americka 23,120 00 Praha 2,Czech Republic
 mailto:[email-masked]  http://nic.cz/
 sip:[email-masked] tel:+420.222745110
 mob:+420.739013699     fax:+420.222745112
 -----------------------------------------

---

From: Ross Finlayson <[email-masked]>
Date: Tue, 24 Mar 2009 17:33:41 -0700

>next ietf?

More generally - shouldn't our protocols be more robust against 
Byzantine agents like these?

	Ross.

---

From: Bill Fenner <[email-masked]>
Date: Tue, 24 Mar 2009 18:33:07 -0700

> Could we please prepare blocking mechanisms for those people at least for

You seem to just have bad luck with being colocated with rogues - all
of the switches block DHCP servers and Router Advertisements.

  Bill

---

From: Randy Bush <[email-masked]>
Date: Tue, 24 Mar 2009 18:51:02 -0700

> Byzantine agents like these?

this is most likely a simple mis-config, not a byzantine agent.  not
even an intentional attack.  and yes, the protocols should not have such
gaping holes.

randy