Inbound dhcp discovery requests on port 68

[CarlyElise]

Does anyone know why i have these requests from external addresses? will blocking these result in any service interruption from my ISP?

 

[ColinTaylor]

It's normal broadcast traffic on your ISP's local network. Ignore it.

 

[Justinh]

It's normal broadcast traffic on your ISP's local network. Ignore it.

Can you explain a bit more? Is this on a CGNAT?

 

[ColinTaylor]

Can you explain a bit more? Is this on a CGNAT?

No it's not CGNAT. I'm not sure what more there is to say really. This is DHCP broadcast traffic. So for example, if a router's "WAN Connection Type" is set to "Automatic IP" (i.e. DHCP) this is the sort of traffic you will be generating on the WAN interface.

 

[Justinh]

I don't know where the OP's data is seen. If it is a router log, then I don't understand how the router's WAN connection type would show this, since the broadcast would be showing on other devices outside of the router's network and interfaces (that is, on devices upstream from the router). Or are you saying the ISP network is broadcasting and since the router is dynamically assigned, it is open to and logging these requests?

(Sorry for being dunce, trying to learn from your post.)

 

[ColinTaylor]

Yes the OP hasn't explained exactly how he's getting this data. It's not something that would appear in an Asus router's syslog so I'm assuming it's a packet capture, either from his router's WAN interface, a firewall device or a (cable)modem. There are also no timestamps so we don't know what time period we're looking at.

But what he's posted would be consistent with 89.187.182.152 being his ISP's local DHCP server (serving multiple customers). And the broadcast packets are replies (DHCPOFFER or DHCPACK) to one or more DHCP clients that have set the "broadcast bit" in their requests. Side note: Asus routers don't set the broadcast bit.

 

[Justinh]

Thanks!