On Sun, Feb 1, 2009 at 3:35 PM, Frank Chiulli frankc.fedora@gmail.com wrote:
Feb 1 09:03:46 localhost kernel: FW-REJECT IN=eth0 OUT= MAC=ff:ff:ff:ff:ff:ff:00:21:47:b7:86:61:08:00 SRC=0.0.0.0 DST=255.255.255.255 LEN=328 TOS=0x00 PREC=0x00 TTL=64 ID=40094 PROTO=UDP SPT=68 DPT=67 LEN=308
I was curious what it was because of 'SRC=0.0.0.0'. It turned out to be my Wii. I discovered this based on my router which keeps track of MAC addresses and IP addresses. I had forgotten that it was on my net.
This is a standard DHCP/BOOTP packet. When a system is booting up it doesn't have an IP address to stick in there so it puts 0.0.0.0. The DHCP server and/or DHCP relay uses the MAC address of the client to send a response back.