|
Re: Firewall spots continuous traffic
UDP traffic?
I see a lot of broadcast DHCP traffic from my UBR - at first, with my firewall identifying is as DHCP, I thought MY system was generating abnormal amounts of DHCP (since the rule called it OUTGOING DHCP), but showing more of the logging parameters identified it as broadcast FROM the UBR.
On startup, you broadcast a DHCP request, the UBR forwards it to the DHCP, and then broadcasts the reply - and you receive all broadcast traffic.
|