Results 1 to 4 of 4

Thread: bootps on xp home

  1. April 27th, 2002, 02:31 PM #1
    Avid
    Avid is offline
    Member
    Join Date
    Mar 2002
    Posts
    88

    bootps on xp home

    Alert 4/27/2002 9:00:17 IP Filter This one time, the user has chosen to "block" communications. Details:
    Inbound UDP packet
    Local address,service is (255.255.255.255,bootps(67))
    Remote address,service is (0.0.0.0,bootpc(68))
    Process name is "N/A"

    A i am like Duh what is trying to connect?
    allot of french information that i found and it all says
    block it but what actually is IT [pong]?[/pong]
    Reply With Quote Reply With Quote
  2. April 28th, 2002, 07:56 PM #2
    xpaciscool
    xpaciscool is offline
    Senior Member
    Join Date
    Dec 2001
    Posts
    137
    Hm. I googled this and found out it was a BootStrap Protocol Server.
    bootps 67/tcp Bootstrap Protocol Server
    bootps 67/udp Bootstrap Protocol Server
    bootpc 68/tcp Bootstrap Protocol Client
    bootpc 68/udp Bootstrap Protocol Client

    I searched google some more and found out that this in fact a trojan Horse. To get rid of this goto start > run > msconfig> startup > and uncheck bootps. If it isn't there goto the Services tab, and find it there.
    XPaCiScOoL

    [glowpurple]\"Your Smallest Flaw is my greatest Strength.\" - Me[/glowpurple]
    Reply With Quote Reply With Quote
  3. April 29th, 2002, 03:48 AM #3
    ammo
    ammo is offline
    Senior Member
    Join Date
    Sep 2001
    Posts
    1,027
    udp port 67 is indeed for bootstrap, and it is NOT a trojan...
    Acutally, bootstrap itself is not much used and is replaced with (what you will probably recongnize) DHCP. DHCP also runs on port 67 (it's an evolution of bootstrap).
    Seeing that the remote address is 0.0.0.0, it sounds like a legit dhcp request brodacast...

    Ammo
    Credit travels up, blame travels down -- The Boss
    Reply With Quote Reply With Quote
  4. April 29th, 2002, 01:39 PM #4
    Vorlin
    Vorlin is offline
    PHP/PostgreSQL guy
    Join Date
    Dec 2001
    Posts
    1,164
    If your machine has "obtain IP address automatically", your NIC will broadcast a udp packet to anything listening on the bootp/dhcp port (67) and looks for the handshake that will allow a responding server to hand off an available IP address. Bootp is hardcoded while DHCP is dynamic.
    We the willing, led by the unknowing, have been doing the impossible for the ungrateful. We have done so much with so little for so long that we are now qualified to do just about anything with almost nothing.
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules