Re: strange messages from -current 'dhcpcd'

[Roy Marples <roy%marples.name@localhost>]

Hi

On 24/06/2016 23:18, John D. Baker wrote:
> I've just noticed some strange log messages emitted by 'dhcpcd' on
> -current (7.99.32).  I've seen these on i386, amd64, and evbarm-earmv7hf.
> 
> They are of the form:
> 
> Jun 18 12:56:53 hostname dhcpcd[PID]: wm0: invalid UDP packet from 19.100.192.168
> Jun 18 12:56:53 hostname dhcpcd[PID]: wm0: invalid UDP packet from 20.12.192.168
> Jun 18 14:15:22 hostname dhcpcd[PID]: wm0: invalid UDP packet from 119.16.192.168
> Jun 23 21:48:35 hostname dhcpcd[PID]: wm0: invalid UDP packet from 150.129.192.168
> Jun 23 18:57:32 hostname dhcpcd[PID]: wm0: invalid UDP packet from 163.85.192.168
> Jun 24 02:56:29 hostname dhcpcd[PID]: wm0: invalid UDP packet from 76.24.192.168
> 
> Needless to say, the purported source IPs are not on my network.  My NAT
> router blocks all incoming traffic except SSH, HTTP, HTTPS and those are
> specifically redirected to hosts other than the ones from which the above
> data were gathered.
> 
> It is curious how they all share the attribute that their last two octets
> are the Class C private allocation prefix.
> 
> These same machines (and others), while running NetBSD-7.0_STABLE (amd64,
> i386, sparc) with 'dhcpcd', have not exhibited such messages.
> 
> (Alas, there are some redmond-OS machines on my network--not by my
> choice....)
> 
> I'm watching the interface with 'tcpdump' on one of the affected machines
> to see if I can get more information.

Can you test this patch please?
http://roy.marples.name/projects/dhcpcd/vpatch?from=4bc1195af1c6a989&to=ca478aacff7bac38

Thanks

Roy